# Flog Txt Version 1 # Analyzer Version: 2.2.0 # Analyzer Build Date: Sep 12 2017 16:39:44 # Log Creation Date: 20.09.2017 16:07:29.127 Process: id = "1" image_name = "ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" page_root = "0x66658000" os_pid = "0x9e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010611" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5 start_va = 0x90000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 6 start_va = 0x190000 end_va = 0x193fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 7 start_va = 0x400000 end_va = 0x447fff entry_point = 0x400000 region_type = mapped_file name = "ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe") Region: id = 8 start_va = 0x77380000 end_va = 0x77528fff entry_point = 0x77380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 9 start_va = 0x77560000 end_va = 0x776dffff entry_point = 0x77560000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 10 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 11 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 12 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 13 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 14 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 15 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 16 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 149 start_va = 0x290000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 150 start_va = 0x73a70000 end_va = 0x73acbfff entry_point = 0x73a70000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 151 start_va = 0x73ad0000 end_va = 0x73b0efff entry_point = 0x73ad0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 152 start_va = 0x73b40000 end_va = 0x73b47fff entry_point = 0x73b40000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 153 start_va = 0x540000 end_va = 0x63ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 154 start_va = 0x75320000 end_va = 0x75365fff entry_point = 0x75320000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 155 start_va = 0x765b0000 end_va = 0x766bffff entry_point = 0x765b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 156 start_va = 0x77160000 end_va = 0x77259fff entry_point = 0x0 region_type = private name = "private_0x0000000077160000" filename = "" Region: id = 157 start_va = 0x77260000 end_va = 0x7737efff entry_point = 0x0 region_type = private name = "private_0x0000000077260000" filename = "" Region: id = 158 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 159 start_va = 0x1a0000 end_va = 0x206fff entry_point = 0x1a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 160 start_va = 0x72940000 end_va = 0x72a92fff entry_point = 0x72940000 region_type = mapped_file name = "msvbvm60.dll" filename = "\\Windows\\SysWOW64\\msvbvm60.dll" (normalized: "c:\\windows\\syswow64\\msvbvm60.dll") Region: id = 161 start_va = 0x750b0000 end_va = 0x750bbfff entry_point = 0x750b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 162 start_va = 0x750c0000 end_va = 0x7511ffff entry_point = 0x750c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 163 start_va = 0x75120000 end_va = 0x7521ffff entry_point = 0x75120000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 164 start_va = 0x75240000 end_va = 0x75258fff entry_point = 0x75240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 165 start_va = 0x75260000 end_va = 0x7530bfff entry_point = 0x75260000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 166 start_va = 0x753c0000 end_va = 0x754affff entry_point = 0x753c0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 167 start_va = 0x754e0000 end_va = 0x7556ffff entry_point = 0x754e0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 168 start_va = 0x75570000 end_va = 0x756cbfff entry_point = 0x75570000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 169 start_va = 0x763e0000 end_va = 0x7646efff entry_point = 0x763e0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 170 start_va = 0x76750000 end_va = 0x76759fff entry_point = 0x76750000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 171 start_va = 0x76760000 end_va = 0x767fffff entry_point = 0x76760000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 172 start_va = 0x76b30000 end_va = 0x76bccfff entry_point = 0x76b30000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 173 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 174 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 175 start_va = 0x640000 end_va = 0x7c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 176 start_va = 0x800000 end_va = 0x80ffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 177 start_va = 0x76a00000 end_va = 0x76acbfff entry_point = 0x76a00000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 178 start_va = 0x76ad0000 end_va = 0x76b2ffff entry_point = 0x76ad0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 179 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 180 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 181 start_va = 0x810000 end_va = 0x990fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 182 start_va = 0x9a0000 end_va = 0x1d9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 183 start_va = 0x1f60000 end_va = 0x1f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 184 start_va = 0x1f70000 end_va = 0x236ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 185 start_va = 0x2370000 end_va = 0x263efff entry_point = 0x2370000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 186 start_va = 0x1da0000 end_va = 0x1f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 187 start_va = 0x360000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 188 start_va = 0x738b0000 end_va = 0x7392ffff entry_point = 0x738b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 189 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 190 start_va = 0x450000 end_va = 0x52efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 191 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 192 start_va = 0x350000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 193 start_va = 0x74ec0000 end_va = 0x74f1efff entry_point = 0x74ec0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 194 start_va = 0x73430000 end_va = 0x73442fff entry_point = 0x73430000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 195 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 196 start_va = 0x270000 end_va = 0x271fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 197 start_va = 0x2640000 end_va = 0x2a32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002640000" filename = "" Region: id = 198 start_va = 0x2a40000 end_va = 0x336ffff entry_point = 0x2a40000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 199 start_va = 0x74e60000 end_va = 0x74eb0fff entry_point = 0x74e60000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 200 start_va = 0x1da0000 end_va = 0x1e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 201 start_va = 0x1f00000 end_va = 0x1f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 202 start_va = 0x310000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 203 start_va = 0x3370000 end_va = 0x346ffff entry_point = 0x0 region_type = private name = "private_0x0000000003370000" filename = "" Region: id = 204 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 205 start_va = 0x280000 end_va = 0x281fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 206 start_va = 0x280000 end_va = 0x280fff entry_point = 0x280000 region_type = mapped_file name = "msctf.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui") Region: id = 207 start_va = 0x3a0000 end_va = 0x3a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 208 start_va = 0x1da0000 end_va = 0x1e1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 209 start_va = 0x1e20000 end_va = 0x1e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 210 start_va = 0x3a0000 end_va = 0x3a8fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 211 start_va = 0x3470000 end_va = 0x746ffff entry_point = 0x0 region_type = private name = "private_0x0000000003470000" filename = "" Region: id = 212 start_va = 0x75790000 end_va = 0x763d9fff entry_point = 0x75790000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 213 start_va = 0x77100000 end_va = 0x77156fff entry_point = 0x77100000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 214 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Thread: id = 1 os_tid = 0x9ec [0023.517] GetVersion () returned 0x1db10106 [0023.553] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x765b0000 [0023.587] GetProcAddress (hModule=0x765b0000, lpProcName="IsTNT") returned 0x0 [0023.587] VirtualAlloc (lpAddress=0x0, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0x1f70000 [0023.588] VirtualAlloc (lpAddress=0x1f70000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f70000 [0023.589] GetCurrentThreadId () returned 0x9ec [0023.589] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe\" " [0023.589] GetEnvironmentStringsW () returned 0x554970* [0023.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0023.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1f607d0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0023.589] FreeEnvironmentStringsW (penv=0x554970) returned 1 [0023.589] GetStartupInfoA (in: lpStartupInfo=0x18f9b8 | out: lpStartupInfo=0x18f9b8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0023.589] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0023.589] GetFileType (hFile=0x0) returned 0x0 [0023.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0023.589] GetFileType (hFile=0x0) returned 0x0 [0023.589] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0023.589] GetFileType (hFile=0x0) returned 0x0 [0023.589] SetHandleCount (uNumber=0x20) returned 0x20 [0023.589] GetACP () returned 0x4e4 [0023.589] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f9e0 | out: lpCPInfo=0x18f9e0) returned 1 [0023.589] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x72a4c528, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe")) returned 0x6a [0023.590] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x765b0000 [0023.590] GetProcAddress (hModule=0x765b0000, lpProcName="IsProcessorFeaturePresent") returned 0x765c5235 [0023.590] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0023.591] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x7c [0023.591] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x80 [0023.592] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0023.592] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x72a4e6c8, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0023.592] GetVersion () returned 0x1db10106 [0023.592] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0023.594] GetUserDefaultLCID () returned 0x409 [0023.594] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0023.594] GetSystemMetrics (nIndex=5) returned 1 [0023.594] GetSystemMetrics (nIndex=6) returned 1 [0023.594] GetSystemMetrics (nIndex=11) returned 32 [0023.595] GetSystemMetrics (nIndex=12) returned 32 [0023.595] GetSystemMetrics (nIndex=34) returned 132 [0023.595] GetSystemMetrics (nIndex=35) returned 38 [0023.595] GetSystemMetrics (nIndex=0) returned 1440 [0023.595] GetSystemMetrics (nIndex=1) returned 900 [0023.595] GetSystemMetrics (nIndex=32) returned 8 [0023.595] GetSystemMetrics (nIndex=33) returned 8 [0023.595] GetSystemMetrics (nIndex=42) returned 0 [0023.595] GetStockObject (i=15) returned 0x188000b [0023.595] GetStockObject (i=7) returned 0x1b00017 [0023.595] GetStockObject (i=6) returned 0x1b00018 [0023.595] GetStockObject (i=8) returned 0x1b00016 [0023.595] GetStockObject (i=4) returned 0x1900011 [0023.595] GetStockObject (i=2) returned 0x1900012 [0023.595] GetStockObject (i=0) returned 0x1900010 [0023.595] GetStockObject (i=5) returned 0x1900015 [0023.595] GetStockObject (i=13) returned 0x18a002e [0023.595] GetDC (hWnd=0x0) returned 0x3010867 [0023.595] GetTextExtentPointA (in: hdc=0x3010867, lpString="0", c=1, lpsz=0x18f9dc | out: lpsz=0x18f9dc) returned 1 [0023.597] GetDeviceCaps (hdc=0x3010867, index=14) returned 1 [0023.597] GetDeviceCaps (hdc=0x3010867, index=12) returned 32 [0023.597] GetDeviceCaps (hdc=0x3010867, index=88) returned 96 [0023.597] GetDeviceCaps (hdc=0x3010867, index=90) returned 96 [0023.597] GetDeviceCaps (hdc=0x3010867, index=38) returned 32409 [0023.597] ReleaseDC (hWnd=0x0, hDC=0x3010867) returned 1 [0023.598] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x72a4e7d0 | out: ppMalloc=0x72a4e7d0*=0x756b66bc) returned 0x0 [0023.598] GetCurrentThreadId () returned 0x9ec [0023.598] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0023.598] GetCurrentThreadId () returned 0x9ec [0023.598] GetCurrentThreadId () returned 0x9ec [0023.598] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe\" " [0023.598] lstrlenA (lpString="") returned 0 [0023.598] lstrcpyA (in: lpString1=0x18feac, lpString2="" | out: lpString1="") returned="" [0023.598] SetErrorMode (uMode=0x8001) returned 0x0 [0023.598] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x18fb68, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0023.598] GetUserDefaultLCID () returned 0x409 [0023.598] lstrcpyA (in: lpString1=0x18f868, lpString2="*" | out: lpString1="*") returned="*" [0023.598] LoadStringA (in: hInstance=0x72940000, uID=0x7d1, lpBuffer=0x18fc6c, cchBufferMax=8 | out: lpBuffer="409") returned 0x3 [0023.598] GetSystemDefaultLCID () returned 0x409 [0023.598] GetUserDefaultLCID () returned 0x409 [0023.598] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x18fc76, cchData=2 | out: lpLCData=".") returned 2 [0023.598] GetStockObject (i=13) returned 0x18a002e [0023.598] GetObjectA (in: h=0x18a002e, c=60, pv=0x18fc3c | out: pv=0x18fc3c) returned 60 [0023.599] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x18fc38, cchData=4 | out: lpLCData="ENU") returned 4 [0023.599] lstrcpyA (in: lpString1=0x18fc68, lpString2="EN" | out: lpString1="EN") returned="EN" [0023.599] lstrlenA (lpString="{xx}") returned 4 [0023.599] lstrlenA (lpString="VB98.CHM") returned 8 [0023.599] lstrcpyA (in: lpString1=0x72a4eae8, lpString2="VB98.CHM" | out: lpString1="VB98.CHM") returned="VB98.CHM" [0023.599] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x18fc38, cchData=4 | out: lpLCData="ENU") returned 4 [0023.599] lstrcpyA (in: lpString1=0x18fc68, lpString2="EN" | out: lpString1="EN") returned="EN" [0023.599] lstrlenA (lpString="{xx}") returned 4 [0023.599] lstrlenA (lpString="VBENLR98.CHM") returned 12 [0023.599] lstrcpyA (in: lpString1=0x72a4ebf0, lpString2="VBENLR98.CHM" | out: lpString1="VBENLR98.CHM") returned="VBENLR98.CHM" [0023.599] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18fd90, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe")) returned 0x6a [0023.599] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x18fc8c, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0023.599] lstrcpynA (in: lpString1=0x18fb70, lpString2="C:\\Windows\\system32\\MSVBVM60.DLL", iMaxLength=260 | out: lpString1="C:\\Windows\\system32\\MSVBVM60.DLL") returned="C:\\Windows\\system32\\MSVBVM60.DLL" [0023.599] lstrlenA (lpString="C:\\Windows\\system32\\MSVBVM60.DLL") returned 32 [0023.599] lstrcpyA (in: lpString1=0x3617b0, lpString2="C:\\Windows\\system32\\MSVBVM60.DLL" | out: lpString1="C:\\Windows\\system32\\MSVBVM60.DLL") returned="C:\\Windows\\system32\\MSVBVM60.DLL" [0023.599] LCMapStringA (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe", cchSrc=-1, lpDestStr=0x18fb50, cchDest=260 | out: lpDestStr="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\AB17C139B27A1884DF468664B2AE448A6BFD8973034B6BFA42D03A3533EDBE8D.EXE") returned 107 [0023.600] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x18fc54, dwRevision=0x1 | out: pSecurityDescriptor=0x18fc54) returned 1 [0023.600] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x18fc54, bDaclPresent=1, pDacl=0x0, bDaclDefaulted=0 | out: pSecurityDescriptor=0x18fc54) returned 1 [0023.600] CreateSemaphoreA (lpSemaphoreAttributes=0x18fc68, lInitialCount=0, lMaximumCount=2147483647, lpName="C:?USERS?5P5NRGJN0JS HALPMCXZ?DESKTOP?AB17C139B27A1884DF468664B2AE448A6BFD8973034B6BFA42D03A3533EDBE8D.EXE") returned 0x90 [0023.600] GetLastError () returned 0x0 [0023.600] GetVersionExA (in: lpVersionInformation=0x18fbcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18fbcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0023.601] OleInitialize (pvReserved=0x0) returned 0x0 [0023.638] OaBuildVersion () returned 0x321396 [0023.638] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x763e0000 [0023.638] GetLastError () returned 0x0 [0023.638] GetProcAddress (hModule=0x763e0000, lpProcName="OleLoadPictureEx") returned 0x764470a1 [0023.638] RegisterClipboardFormatA (lpszFormat="Link") returned 0xc144 [0023.639] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc0b2 [0023.639] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBFocusRT6", lpWndClass=0x18fc34 | out: lpWndClass=0x18fc34) returned 0 [0023.639] RegisterClassA (lpWndClass=0x18fc34) returned 0xc142 [0023.639] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBBubbleRT6", lpWndClass=0x18fc34 | out: lpWndClass=0x18fc34) returned 0 [0023.639] RegisterClassA (lpWndClass=0x18fc34) returned 0xc13a [0023.639] GetUserDefaultLCID () returned 0x409 [0023.639] GetSystemInfo (in: lpSystemInfo=0x18fbf4 | out: lpSystemInfo=0x18fbf4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x3, dwNumberOfProcessors=0x2, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0023.639] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x250000 [0023.640] VirtualAlloc (lpAddress=0x250000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.640] VirtualAlloc (lpAddress=0x250000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.640] VirtualAlloc (lpAddress=0x250000, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.641] VirtualAlloc (lpAddress=0x250000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.641] VirtualAlloc (lpAddress=0x250000, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.641] VirtualAlloc (lpAddress=0x250000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.641] VirtualProtect (in: lpAddress=0x250000, dwSize=0x6000, flNewProtect=0x20, lpflOldProtect=0x18fc50 | out: lpflOldProtect=0x18fc50*=0x4) returned 1 [0023.641] GetCurrentProcess () returned 0xffffffff [0023.641] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x250000, dwSize=0x6000) returned 1 [0023.641] GlobalAddAtomA (lpString="VBDisabled") returned 0xc0ea [0023.641] GetVersion () returned 0x1db10106 [0023.641] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x763e0000 [0023.642] GetProcAddress (hModule=0x763e0000, lpProcName="DispCallFunc") returned 0x763f3dcf [0023.642] GetProcAddress (hModule=0x763e0000, lpProcName="LoadTypeLibEx") returned 0x763f07b7 [0023.642] GetProcAddress (hModule=0x763e0000, lpProcName="UnRegisterTypeLib") returned 0x76411ca9 [0023.642] GetProcAddress (hModule=0x763e0000, lpProcName="CreateTypeLib2") returned 0x763f8e70 [0023.642] GetProcAddress (hModule=0x763e0000, lpProcName="VarDateFromUdate") returned 0x763f7684 [0023.642] GetProcAddress (hModule=0x763e0000, lpProcName="VarUdateFromDate") returned 0x763fcc98 [0023.642] GetProcAddress (hModule=0x763e0000, lpProcName="GetAltMonthNames") returned 0x7642903a [0023.642] GetProcAddress (hModule=0x763e0000, lpProcName="VarNumFromParseNum") returned 0x763f6231 [0023.642] GetProcAddress (hModule=0x763e0000, lpProcName="VarParseNumFromStr") returned 0x763f5fea [0023.642] GetProcAddress (hModule=0x763e0000, lpProcName="VarDecFromR4") returned 0x76403f94 [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="VarDecFromR8") returned 0x76404e9e [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="VarDecFromDate") returned 0x7642db72 [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="VarDecFromI4") returned 0x76412a8c [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="VarDecFromCy") returned 0x7642d737 [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="VarR4FromDec") returned 0x7642e015 [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x7642cc3d [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="GetRecordInfoFromGuids") returned 0x7642d1c4 [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="SafeArrayGetRecordInfo") returned 0x7642d48c [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="SafeArraySetRecordInfo") returned 0x7642d4c6 [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="SafeArrayGetIID") returned 0x7642d509 [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="SafeArraySetIID") returned 0x763fe7bb [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="SafeArrayCopyData") returned 0x763fe496 [0023.643] GetProcAddress (hModule=0x763e0000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x763fddf1 [0023.644] GetProcAddress (hModule=0x763e0000, lpProcName="SafeArrayCreateEx") returned 0x7642d53f [0023.644] GetProcAddress (hModule=0x763e0000, lpProcName="VarFormat") returned 0x76432055 [0023.644] GetProcAddress (hModule=0x763e0000, lpProcName="VarFormatDateTime") returned 0x764320ea [0023.644] GetProcAddress (hModule=0x763e0000, lpProcName="VarFormatNumber") returned 0x76432151 [0023.644] GetProcAddress (hModule=0x763e0000, lpProcName="VarFormatPercent") returned 0x764321f5 [0023.644] GetProcAddress (hModule=0x763e0000, lpProcName="VarFormatCurrency") returned 0x76432288 [0023.644] GetProcAddress (hModule=0x763e0000, lpProcName="VarWeekdayName") returned 0x76432335 [0023.644] GetProcAddress (hModule=0x763e0000, lpProcName="VarMonthName") returned 0x764323d5 [0023.644] GetProcAddress (hModule=0x763e0000, lpProcName="VarAdd") returned 0x76405934 [0023.644] GetProcAddress (hModule=0x763e0000, lpProcName="VarAnd") returned 0x76405a98 [0023.644] GetProcAddress (hModule=0x763e0000, lpProcName="VarCat") returned 0x764059b4 [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarDiv") returned 0x7645e405 [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarEqv") returned 0x7645ef07 [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarIdiv") returned 0x7645f00a [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarImp") returned 0x7645ef47 [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarMod") returned 0x7645f15e [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarMul") returned 0x7645dbd4 [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarOr") returned 0x7645ecfa [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarPow") returned 0x7645ea66 [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarSub") returned 0x7645d332 [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarXor") returned 0x7645ee2e [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarAbs") returned 0x7645ca11 [0023.645] GetProcAddress (hModule=0x763e0000, lpProcName="VarFix") returned 0x7645cc5f [0023.646] GetProcAddress (hModule=0x763e0000, lpProcName="VarInt") returned 0x7645cde7 [0023.646] GetProcAddress (hModule=0x763e0000, lpProcName="VarNeg") returned 0x7645c802 [0023.646] GetProcAddress (hModule=0x763e0000, lpProcName="VarNot") returned 0x7645ec66 [0023.646] GetProcAddress (hModule=0x763e0000, lpProcName="VarRound") returned 0x7645d155 [0023.646] GetProcAddress (hModule=0x763e0000, lpProcName="VarCmp") returned 0x763fb0dc [0023.646] GetProcAddress (hModule=0x763e0000, lpProcName="VarDecAdd") returned 0x76415f3e [0023.646] GetProcAddress (hModule=0x763e0000, lpProcName="VarDecCmp") returned 0x76404fd0 [0023.646] GetProcAddress (hModule=0x763e0000, lpProcName="VarBstrCat") returned 0x76400d2c [0023.646] GetProcAddress (hModule=0x763e0000, lpProcName="VarCyMulI4") returned 0x764159ed [0023.646] GetProcAddress (hModule=0x763e0000, lpProcName="VarBstrCmp") returned 0x763ef8b8 [0023.646] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x75570000 [0023.646] GetProcAddress (hModule=0x75570000, lpProcName="CoCreateInstanceEx") returned 0x755b9d4e [0023.646] GetProcAddress (hModule=0x75570000, lpProcName="CLSIDFromProgIDEx") returned 0x75580782 [0023.647] GetSystemMetrics (nIndex=42) returned 0 [0023.647] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x72a4e688 | out: ppMalloc=0x72a4e688*=0x756b66bc) returned 0x0 [0023.647] IMalloc:Alloc (This=0x756b66bc, cb=0x4) returned 0x558ee0 [0023.647] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f968, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe")) returned 0x6a [0023.647] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe", lpString2=".cfg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe.cfg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe.cfg" [0023.648] SetLastError (dwErrCode=0x0) [0023.648] SearchPathA (in: lpPath=0x0, lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe.cfg", lpExtension=0x0, nBufferLength=0x103, lpBuffer=0x18f864, lpFilePart=0x18f838 | out: lpBuffer="|ú\x18", lpFilePart=0x18f838) returned 0x0 [0023.648] SetLastError (dwErrCode=0x2) [0023.648] GetLastError () returned 0x2 [0023.648] lstrcmpiA (lpString1="ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d", lpString2="MTX") returned -1 [0023.648] lstrcmpiA (lpString1="ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d", lpString2="DLLHOST") returned -1 [0023.648] lstrcmpiA (lpString1="ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d", lpString2="INETINFO") returned -1 [0023.648] lstrcmpiA (lpString1="ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d", lpString2="W3WP") returned -1 [0023.648] lstrcmpiA (lpString1="ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d", lpString2="ASPNET_WP") returned -1 [0023.648] lstrcmpiA (lpString1="ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d", lpString2="DLLHST3G") returned -1 [0023.648] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f95c, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe")) returned 0x6a [0023.648] lstrcmpiA (lpString1="ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d", lpString2="IEXPLORE") returned -1 [0023.648] LoadLibraryA (lpLibFileName="SXS.DLL") returned 0x74ec0000 [0023.876] GetLastError () returned 0x0 [0023.876] GetProcAddress (hModule=0x74ec0000, lpProcName="SxsOleAut32MapIIDOrCLSIDToTypeLibrary") returned 0x74f07685 [0023.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18feac, cbMultiByte=-1, lpWideCharStr=0x18fea8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0023.876] CoRegisterMessageFilter (in: lpMessageFilter=0x362054, lplpMessageFilter=0x36205c | out: lplpMessageFilter=0x36205c*=0x0) returned 0x0 [0023.876] IUnknown:AddRef (This=0x362054) returned 0x2 [0023.876] GetClassInfoExA (in: hInstance=0x72940000, lpszClass="ThunderRT6Main", lpwcx=0x18fe78 | out: lpwcx=0x18fe78) returned 0 [0023.876] LoadIconA (hInstance=0x400000, lpIconName=0x1) returned 0x70105 [0023.877] GetModuleHandleA (lpModuleName="USER32") returned 0x75120000 [0023.877] GetProcAddress (hModule=0x75120000, lpProcName="GetSystemMetrics") returned 0x75137d2f [0023.877] GetProcAddress (hModule=0x75120000, lpProcName="MonitorFromWindow") returned 0x75143150 [0023.877] GetProcAddress (hModule=0x75120000, lpProcName="MonitorFromRect") returned 0x7515e7a0 [0023.877] GetProcAddress (hModule=0x75120000, lpProcName="MonitorFromPoint") returned 0x75145281 [0023.877] GetProcAddress (hModule=0x75120000, lpProcName="EnumDisplayMonitors") returned 0x7514451a [0023.877] GetProcAddress (hModule=0x75120000, lpProcName="GetMonitorInfoA") returned 0x75144413 [0023.877] GetSystemMetrics (nIndex=0) returned 1440 [0023.877] GetSystemMetrics (nIndex=78) returned 1440 [0023.877] GetSystemMetrics (nIndex=1) returned 900 [0023.877] GetSystemMetrics (nIndex=79) returned 900 [0023.878] GetSystemMetrics (nIndex=50) returned 16 [0023.878] GetSystemMetrics (nIndex=49) returned 16 [0023.878] LoadImageA (hInst=0x400000, name=0x1, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x7006b [0023.878] RegisterClassExA (param_1=0x18fe78) returned 0x8ec13c [0023.878] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderRT6Main", lpWindowName=0x0, dwStyle=0x80090000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x3015a [0023.878] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x81, wParam=0x0, lParam=0x18fa5c) returned 0x1 [0023.879] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x83, wParam=0x0, lParam=0x18fa48) returned 0x0 [0023.879] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x1, wParam=0x0, lParam=0x18fa5c) returned 0x0 [0023.879] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0023.879] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0023.879] MonitorFromWindow (hwnd=0x3015a, dwFlags=0x2) returned 0x10001 [0023.879] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x18fe80 | out: lpmi=0x18fe80) returned 1 [0023.879] SetWindowPos (hWnd=0x3015a, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0023.879] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x46, wParam=0x0, lParam=0x18fe20) returned 0x0 [0023.880] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x47, wParam=0x0, lParam=0x18fe20) returned 0x0 [0023.880] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x3, wParam=0x0, lParam=0x1c202d0) returned 0x0 [0023.880] ShowWindow (hWnd=0x3015a, nCmdShow=4) returned 0 [0023.880] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0023.880] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x46, wParam=0x0, lParam=0x18fe34) returned 0x0 [0023.880] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x47, wParam=0x0, lParam=0x18fe34) returned 0x0 [0023.880] GetWindowThreadProcessId (in: hWnd=0x3015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9ec [0023.880] VirtualQuery (in: lpAddress=0x18fea8, lpBuffer=0x18fe8c, dwLength=0x1c | out: lpBuffer=0x18fe8c*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0023.880] GetUserDefaultLCID () returned 0x409 [0023.880] IsValidCodePage (CodePage=0x3a4) returned 1 [0023.882] IsValidCodePage (CodePage=0x3b5) returned 1 [0023.883] IsValidCodePage (CodePage=0x3b6) returned 1 [0023.885] IsValidCodePage (CodePage=0x3a8) returned 1 [0023.894] GetUserDefaultLangID () returned 0x409 [0023.894] GetSystemDefaultLangID () returned 0x550409 [0023.894] GetSystemMetrics (nIndex=42) returned 0 [0023.894] IMalloc:Alloc (This=0x756b66bc, cb=0xa8) returned 0x55d600 [0023.894] IMalloc:GetSize (This=0x756b66bc, pv=0x55d600) returned 0xa8 [0023.894] IMalloc:Alloc (This=0x756b66bc, cb=0xc) returned 0x55cd28 [0023.894] GetCurrentThreadId () returned 0x9ec [0023.894] IMalloc:Alloc (This=0x756b66bc, cb=0x3c) returned 0x558ef0 [0023.894] IMalloc:Alloc (This=0x756b66bc, cb=0x1c) returned 0x5596b8 [0023.933] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x18fe74 | out: phkResult=0x18fe74*=0x0) returned 0x2 [0023.934] IMalloc:Alloc (This=0x756b66bc, cb=0x1c) returned 0x5596e0 [0023.934] GetCurrentThreadId () returned 0x9ec [0023.934] SetWindowsHookExA (idHook=-1, lpfn=0x729a1e09, hmod=0x0, dwThreadId=0x9ec) returned 0x170101 [0023.934] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBMsoStdCompMgr", lpWndClass=0x18fdcc | out: lpWndClass=0x18fdcc) returned 0 [0023.934] RegisterClassA (lpWndClass=0x18fdcc) returned 0x98c13d [0023.934] CreateWindowExA (dwExStyle=0x0, lpClassName="VBMsoStdCompMgr", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x201c2 [0023.934] NtdllDefWindowProc_A (hWnd=0x201c2, Msg=0x81, wParam=0x0, lParam=0x18fa08) returned 0x1 [0023.934] NtdllDefWindowProc_A (hWnd=0x201c2, Msg=0x83, wParam=0x0, lParam=0x18f9f4) returned 0x0 [0023.934] NtdllDefWindowProc_A (hWnd=0x201c2, Msg=0x1, wParam=0x0, lParam=0x18fa08) returned 0x0 [0023.934] NtdllDefWindowProc_A (hWnd=0x201c2, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0023.934] NtdllDefWindowProc_A (hWnd=0x201c2, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0023.934] SetWindowLongA (hWnd=0x201c2, nIndex=0, dwNewLong=3547292) returned 0 [0023.934] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0023.935] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0023.935] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0023.935] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0023.935] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0023.935] RegisterClipboardFormatA (lpszFormat="OwnerLink") returned 0xc003 [0023.935] RegisterClipboardFormatA (lpszFormat="FileName") returned 0xc006 [0023.935] CreateCompatibleDC (hdc=0x0) returned 0x3f01021e [0023.935] GetCurrentObject (hdc=0x3f01021e, type=0x7) returned 0x185000f [0023.935] CreateWindowExA (dwExStyle=0x0, lpClassName="VBFocusRT6", lpWindowName=0x0, dwStyle=0x40000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x3015a, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x201c4 [0023.935] NtdllDefWindowProc_A (hWnd=0x201c4, Msg=0x81, wParam=0x0, lParam=0x18fa98) returned 0x1 [0023.935] NtdllDefWindowProc_A (hWnd=0x201c4, Msg=0x83, wParam=0x0, lParam=0x18fa84) returned 0x0 [0023.935] NtdllDefWindowProc_A (hWnd=0x201c4, Msg=0x1, wParam=0x0, lParam=0x18fa98) returned 0x0 [0023.935] NtdllDefWindowProc_A (hWnd=0x201c4, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0023.935] NtdllDefWindowProc_A (hWnd=0x201c4, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0023.935] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x210, wParam=0x1, lParam=0x201c4) returned 0x0 [0023.935] GetCurrentThreadId () returned 0x9ec [0023.935] GetCurrentThreadId () returned 0x9ec [0023.936] lstrlenA (lpString="VB") returned 2 [0023.936] lstrlenA (lpString="CommandButton") returned 13 [0023.945] lstrlenA (lpString="VB") returned 2 [0023.945] lstrlenA (lpString="Printer") returned 7 [0023.945] lstrlenA (lpString="VB") returned 2 [0023.945] lstrlenA (lpString="Form") returned 4 [0023.945] lstrlenA (lpString="VB") returned 2 [0023.945] lstrlenA (lpString="Screen") returned 6 [0023.945] lstrlenA (lpString="VB") returned 2 [0023.945] lstrlenA (lpString="Clipboard") returned 9 [0023.946] lstrlenA (lpString="VB") returned 2 [0023.946] lstrlenA (lpString="MDIForm") returned 7 [0023.946] lstrlenA (lpString="VB") returned 2 [0023.946] lstrlenA (lpString="App") returned 3 [0023.946] lstrlenA (lpString="VB") returned 2 [0023.946] lstrlenA (lpString="UserControl") returned 11 [0023.946] lstrlenA (lpString="VB") returned 2 [0023.946] lstrlenA (lpString="PropertyPage") returned 12 [0023.947] lstrcmpiA (lpString1="VB.MDIForm", lpString2="VB.PropertyPage") returned -1 [0023.947] lstrlenA (lpString="VB") returned 2 [0023.947] lstrlenA (lpString="UserDocument") returned 12 [0023.948] GetCurrentThreadId () returned 0x9ec [0023.948] GetCurrentThreadId () returned 0x9ec [0023.948] GetCurrentThreadId () returned 0x9ec [0023.948] GetCurrentThreadId () returned 0x9ec [0023.949] GetCurrentThreadId () returned 0x9ec [0023.949] GetCurrentThreadId () returned 0x9ec [0023.949] lstrlenA (lpString="VB") returned 2 [0023.949] lstrlenA (lpString="PictureBox") returned 10 [0023.949] lstrlenA (lpString="VB") returned 2 [0023.949] lstrlenA (lpString="Label") returned 5 [0023.949] lstrlenA (lpString="VB") returned 2 [0023.949] lstrlenA (lpString="TextBox") returned 7 [0023.950] lstrlenA (lpString="VB") returned 2 [0023.950] lstrlenA (lpString="Frame") returned 5 [0023.950] lstrlenA (lpString="VB") returned 2 [0023.950] lstrlenA (lpString="CheckBox") returned 8 [0023.950] lstrlenA (lpString="VB") returned 2 [0023.950] lstrlenA (lpString="OptionButton") returned 12 [0023.950] lstrlenA (lpString="VB") returned 2 [0023.950] lstrlenA (lpString="ComboBox") returned 8 [0023.951] lstrlenA (lpString="VB") returned 2 [0023.951] lstrlenA (lpString="ListBox") returned 7 [0023.951] lstrlenA (lpString="VB") returned 2 [0023.951] lstrlenA (lpString="HScrollBar") returned 10 [0023.951] lstrlenA (lpString="VB") returned 2 [0023.951] lstrlenA (lpString="VScrollBar") returned 10 [0023.951] lstrlenA (lpString="VB") returned 2 [0023.951] lstrlenA (lpString="Timer") returned 5 [0023.952] lstrlenA (lpString="VB") returned 2 [0023.952] lstrlenA (lpString="DriveListBox") returned 12 [0023.952] lstrlenA (lpString="VB") returned 2 [0023.952] lstrlenA (lpString="DirListBox") returned 10 [0023.952] lstrlenA (lpString="VB") returned 2 [0023.952] lstrlenA (lpString="FileListBox") returned 11 [0023.953] lstrlenA (lpString="VB") returned 2 [0023.953] lstrlenA (lpString="Menu") returned 4 [0023.953] lstrlenA (lpString="VB") returned 2 [0023.953] lstrlenA (lpString="Shape") returned 5 [0023.953] lstrlenA (lpString="VB") returned 2 [0023.953] lstrlenA (lpString="Line") returned 4 [0023.954] lstrlenA (lpString="VB") returned 2 [0023.954] lstrlenA (lpString="Image") returned 5 [0023.954] lstrlenA (lpString="VB") returned 2 [0023.954] lstrlenA (lpString="Data") returned 4 [0023.954] lstrlenA (lpString="VB") returned 2 [0023.954] lstrlenA (lpString="OLE") returned 3 [0023.955] IMalloc:Alloc (This=0x756b66bc, cb=0x64) returned 0x559e90 [0023.955] IMalloc:Alloc (This=0x756b66bc, cb=0x64) returned 0x55d6b0 [0023.955] IMalloc:Alloc (This=0x756b66bc, cb=0x64) returned 0x55d720 [0023.955] IMalloc:Alloc (This=0x756b66bc, cb=0x64) returned 0x55d790 [0023.955] IMalloc:Alloc (This=0x756b66bc, cb=0xc) returned 0x55cd40 [0023.955] IMalloc:Alloc (This=0x756b66bc, cb=0x68) returned 0x55d800 [0023.955] IMalloc:GetSize (This=0x756b66bc, pv=0x55d800) returned 0x68 [0023.955] IMalloc:Alloc (This=0x756b66bc, cb=0x20) returned 0x559898 [0023.983] GetCurrentThreadId () returned 0x9ec [0023.983] GetCurrentThreadId () returned 0x9ec [0023.983] IMalloc:Alloc (This=0x756b66bc, cb=0x1c) returned 0x5598c0 [0023.984] VirtualProtect (in: lpAddress=0x250000, dwSize=0x6000, flNewProtect=0x4, lpflOldProtect=0x18fdf8 | out: lpflOldProtect=0x18fdf8*=0x20) returned 1 [0023.984] GetCurrentProcess () returned 0xffffffff [0023.984] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x250000, dwSize=0x6000) returned 1 [0023.984] VirtualAlloc (lpAddress=0x250000, dwSize=0x7000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.984] VirtualAlloc (lpAddress=0x250000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.984] VirtualAlloc (lpAddress=0x250000, dwSize=0x9000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.984] VirtualAlloc (lpAddress=0x250000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.984] VirtualProtect (in: lpAddress=0x250000, dwSize=0xa000, flNewProtect=0x20, lpflOldProtect=0x18fdf8 | out: lpflOldProtect=0x18fdf8*=0x4) returned 1 [0023.984] GetCurrentProcess () returned 0xffffffff [0023.984] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x250000, dwSize=0xa000) returned 1 [0023.984] GetCurrentThreadId () returned 0x9ec [0023.991] GetCurrentThreadId () returned 0x9ec [0023.991] SetWindowTextA (hWnd=0x3015a, lpString="Saberbill8") returned 1 [0023.991] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0xc, wParam=0x0, lParam=0x18fd6c) returned 0x1 [0023.991] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x18fd54 | out: phkResult=0x18fd54*=0x0) returned 0x2 [0023.992] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0023.992] VirtualQuery (in: lpAddress=0x18f780, lpBuffer=0x18f764, dwLength=0x1c | out: lpBuffer=0x18f764*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0023.995] IMalloc:Alloc (This=0x756b66bc, cb=0x64) returned 0x55e8a0 [0023.995] IMalloc:GetSize (This=0x756b66bc, pv=0x55e8a0) returned 0x64 [0023.997] GetCurrentThreadId () returned 0x9ec [0023.997] GetCurrentThreadId () returned 0x9ec [0023.997] GetCurrentThreadId () returned 0x9ec [0024.003] GetCurrentThreadId () returned 0x9ec [0024.004] GetCurrentThreadId () returned 0x9ec [0024.005] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xb4 [0024.006] GetVersionExA (in: lpVersionInformation=0x18fa7c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x1365d0c, dwMinorVersion=0x18f9cc, dwBuildNumber=0x18fd00, dwPlatformId=0x18ff70, szCSDVersion="Í\x1e]w½\x0c>") | out: lpVersionInformation=0x18fa7c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0024.006] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x72992cd8, cbMultiByte=-1, lpWideCharStr=0x18faa4, cchWideChar=14 | out: lpWideCharStr="MS Sans Serif") returned 14 [0024.007] OleCreateFontIndirect () returned 0x0 [0024.086] lstrlenA (lpString="Southlander") returned 11 [0024.087] LoadIconA (hInstance=0x72940000, lpIconName=0x4b1) returned 0xd016d [0024.088] OleCreatePictureIndirect () returned 0x0 [0024.088] lstrlenA (lpString="Southlander") returned 11 [0024.088] lstrlenA (lpString="ThunderRT6") returned 10 [0024.088] lstrcpyA (in: lpString1=0x18fab8, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0024.088] lstrlenA (lpString="ThunderRT6Form") returned 14 [0024.088] lstrcpynA (in: lpString1=0x18fac6, lpString2="DC", iMaxLength=116 | out: lpString1="DC") returned="DC" [0024.088] lstrlenA (lpString="ThunderRT6") returned 10 [0024.088] lstrcpyA (in: lpString1=0x18fa4c, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0024.089] GetClassInfoA (in: hInstance=0x72940000, lpClassName="ThunderRT6Form", lpWndClass=0x18fa78 | out: lpWndClass=0x18fa78) returned 0 [0024.089] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0024.089] RegisterClassA (lpWndClass=0x18fa78) returned 0xd9c13f [0024.089] lstrlenA (lpString="ThunderRT6") returned 10 [0024.089] lstrcpyA (in: lpString1=0x18fa4c, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0024.089] lstrlenA (lpString="ThunderRT6Form") returned 14 [0024.089] lstrcpynA (in: lpString1=0x18fa5a, lpString2="DC", iMaxLength=29 | out: lpString1="DC") returned="DC" [0024.089] RegisterClassA (lpWndClass=0x18fa78) returned 0xc143 [0024.089] AdjustWindowRectEx (in: lpRect=0x18fb78, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x18fb78) returned 1 [0024.089] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc143, lpWindowName="Southlander", dwStyle=0x2cf0000, X=265, Y=252, nWidth=151, nHeight=78, hWndParent=0x3015a, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x201c6 [0024.089] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x81, wParam=0x0, lParam=0x18f69c) returned 0x1 [0024.089] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x83, wParam=0x0, lParam=0x18f688) returned 0x0 [0024.101] GetSystemMenu (hWnd=0x201c6, bRevert=0) returned 0x190131 [0024.102] SetWindowContextHelpId (param_1=0x201c6, param_2=0xffffffff) returned 1 [0024.102] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x1, wParam=0x0, lParam=0x18f69c) returned 0x0 [0024.102] GetDC (hWnd=0x201c6) returned 0x2a01019b [0024.102] GetTextMetricsA (in: hdc=0x2a01019b, lptm=0x18fa64 | out: lptm=0x18fa64) returned 1 [0024.102] SetBkMode (hdc=0x2a01019b, mode=1) returned 2 [0024.103] OleTranslateColor () returned 0x0 [0024.103] SetBkColor (hdc=0x2a01019b, color=0xf0f0f0) returned 0xffffff [0024.103] OleTranslateColor () returned 0x0 [0024.103] SetTextColor (hdc=0x2a01019b, color=0x0) returned 0x0 [0024.103] OleTranslateColor () returned 0x0 [0024.103] CreatePen (iStyle=0, cWidth=1, color=0x0) returned 0x2f30007f [0024.103] SelectObject (hdc=0x2a01019b, h=0x2f30007f) returned 0x1b00017 [0024.103] SelectObject (hdc=0x2a01019b, h=0x1900011) returned 0x1900010 [0024.103] ClientToScreen (in: hWnd=0x201c6, lpPoint=0x18fa44 | out: lpPoint=0x18fa44) returned 1 [0024.103] SetBrushOrgEx (in: hdc=0x2a01019b, x=1, y=2, lppt=0x0 | out: lppt=0x0) returned 1 [0024.103] UnrealizeObject (h=0x1900015) returned 1 [0024.103] SelectObject (hdc=0x2a01019b, h=0x1900015) returned 0x1900011 [0024.104] SelectObject (hdc=0x2a01019b, h=0x2a0a0194) returned 0x18a002e [0024.104] GetTextMetricsA (in: hdc=0x2a01019b, lptm=0x18f858 | out: lptm=0x18f858) returned 1 [0024.105] lstrlenA (lpString="Southlander") returned 11 [0024.105] lstrlenA (lpString="ThunderRT6") returned 10 [0024.105] lstrcpyA (in: lpString1=0x18fa88, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0024.105] lstrlenA (lpString="ThunderRT6") returned 10 [0024.105] lstrcpyA (in: lpString1=0x18fa1c, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0024.105] GetClassInfoA (in: hInstance=0x0, lpClassName="Button", lpWndClass=0x18fa48 | out: lpWndClass=0x18fa48) returned 1 [0024.105] GetClassInfoA (in: hInstance=0x72940000, lpClassName="ThunderRT6CommandButton", lpWndClass=0x18fa48 | out: lpWndClass=0x18fa48) returned 0 [0024.105] RegisterClassA (lpWndClass=0x18fa48) returned 0xc139 [0024.105] CreateWindowExA (dwExStyle=0x4, lpClassName=0xc139, lpWindowName="Southlander", dwStyle=0x44012000, X=528, Y=296, nWidth=265, nHeight=145, hWndParent=0x201c6, hMenu=0x1, hInstance=0x72940000, lpParam=0x0) returned 0x201c8 [0024.105] CallWindowProcA (lpPrevWndFunc=0x775dabd3, hWnd=0x201c8, Msg=0x81, wParam=0x0, lParam=0x18f66c) returned 0x1 [0024.106] CallWindowProcA (lpPrevWndFunc=0x775dabd3, hWnd=0x201c8, Msg=0x83, wParam=0x0, lParam=0x18f658) returned 0x0 [0024.106] CallWindowProcA (lpPrevWndFunc=0x775dabd3, hWnd=0x201c8, Msg=0x1, wParam=0x0, lParam=0x18f66c) returned 0x0 [0024.106] CallWindowProcA (lpPrevWndFunc=0x775dabd3, hWnd=0x201c8, Msg=0x5, wParam=0x0, lParam=0x910109) returned 0x0 [0024.106] CallWindowProcA (lpPrevWndFunc=0x775dabd3, hWnd=0x201c8, Msg=0x3, wParam=0x0, lParam=0x1280210) returned 0x0 [0024.106] CallWindowProcA (lpPrevWndFunc=0x775dabd3, hWnd=0x201c8, Msg=0x30, wParam=0x2a0a0194, lParam=0x0) returned 0x0 [0024.106] ShowWindow (hWnd=0x201c8, nCmdShow=5) returned 0 [0024.106] CallWindowProcA (lpPrevWndFunc=0x775dabd3, hWnd=0x201c8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0024.106] GetClientRect (in: hWnd=0x201c6, lpRect=0x18fbf8 | out: lpRect=0x18fbf8) returned 1 [0024.106] MapWindowPoints (in: hWndFrom=0x201c6, hWndTo=0x0, lpPoints=0x18fbf8, cPoints=0x2 | out: lpPoints=0x18fbf8) returned 18481425 [0024.106] EqualRect (lprc1=0x18fbf8, lprc2=0x18fbd8) returned 1 [0024.106] SetEvent (hEvent=0xb4) returned 1 [0024.106] IsIconic (hWnd=0x201c6) returned 0 [0024.106] SendMessageA (hWnd=0x201c6, Msg=0x80, wParam=0x1, lParam=0xd016d) returned 0x0 [0024.107] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x80, wParam=0x1, lParam=0xd016d) returned 0x0 [0024.116] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x201cd [0024.118] IsIconic (hWnd=0x201c6) returned 0 [0024.118] IsZoomed (hWnd=0x201c6) returned 0 [0024.118] GetClientRect (in: hWnd=0x201c6, lpRect=0x18fbec | out: lpRect=0x18fbec) returned 1 [0024.118] GetWindow (hWnd=0x201c6, uCmd=0x5) returned 0x201c8 [0024.118] GetWindow (hWnd=0x201c8, uCmd=0x2) returned 0x0 [0024.118] GetParent (hWnd=0x201c8) returned 0x201c6 [0024.118] SetErrorMode (uMode=0x8001) returned 0x8001 [0024.118] LoadLibraryA (lpLibFileName="ADVAPI32.DLL") returned 0x76760000 [0024.118] SetErrorMode (uMode=0x8001) returned 0x8001 [0024.118] GetProcAddress (hModule=0x76760000, lpProcName="CloseEventLog") returned 0x767677c3 [0024.118] CloseEventLog (hEventLog=0x0) returned 0 [0024.119] GetLastError () returned 0x6 [0024.119] SetErrorMode (uMode=0x8001) returned 0x8001 [0024.119] LoadLibraryA (lpLibFileName="ADVAPI32.DLL") returned 0x76760000 [0024.119] SetErrorMode (uMode=0x8001) returned 0x8001 [0024.119] GetProcAddress (hModule=0x76760000, lpProcName="SetAclInformation") returned 0x767a34e3 [0024.120] SetAclInformation (in: pAcl=0x18fa78, pAclInformation=0x18fa7c, nAclInformationLength=0x0, dwAclInformationClass=0x0 | out: pAcl=0x18fa78) returned 0 [0024.120] GetLastError () returned 0x57 [0024.120] SetErrorMode (uMode=0x8001) returned 0x8001 [0024.120] LoadLibraryA (lpLibFileName="user32") returned 0x75120000 [0024.120] SetErrorMode (uMode=0x8001) returned 0x8001 [0024.121] GetProcAddress (hModule=0x75120000, lpProcName="CreateDialogIndirectParamA") returned 0x7514b029 [0024.121] CreateDialogIndirectParamA (hInstance=0x0, lpTemplate=0x18fa78, hWndParent=0x0, lpDialogFunc=0x0, dwInitParam=0x0) returned 0x0 [0024.271] GetLastError () returned 0x715 [0024.271] GetUserDefaultLCID () returned 0x409 [0024.271] VarBstrFromI2 (iVal=0, lcid=0x409, dwFlags=0x0, pbstrOut=0x18fa3c) returned 0x0 [0024.326] SysStringLen (param_1="0") returned 0x1 [0024.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0024.326] SysStringLen (param_1="0") returned 0x1 [0024.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=2, lpMultiByteStr=0x55cdec, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0", lpUsedDefaultChar=0x0) returned 2 [0024.326] GetUserDefaultLCID () returned 0x409 [0024.326] VarBstrFromI2 (iVal=0, lcid=0x409, dwFlags=0x0, pbstrOut=0x18fa38) returned 0x0 [0024.326] SysStringLen (param_1="0") returned 0x1 [0024.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0024.326] SysStringLen (param_1="0") returned 0x1 [0024.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=2, lpMultiByteStr=0x55ce34, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0", lpUsedDefaultChar=0x0) returned 2 [0024.326] GetUserDefaultLCID () returned 0x409 [0024.326] VarBstrFromI2 (iVal=0, lcid=0x409, dwFlags=0x0, pbstrOut=0x18fa34) returned 0x0 [0024.326] SysStringLen (param_1="0") returned 0x1 [0024.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0024.326] SysStringLen (param_1="0") returned 0x1 [0024.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=2, lpMultiByteStr=0x55ce64, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0", lpUsedDefaultChar=0x0) returned 2 [0024.326] SetErrorMode (uMode=0x8001) returned 0x8001 [0024.327] LoadLibraryA (lpLibFileName="winspool.drv") returned 0x74e60000 [0024.354] SetErrorMode (uMode=0x8001) returned 0x8001 [0024.354] GetProcAddress (hModule=0x74e60000, lpProcName="DeletePrintProcessorA") returned 0x74e68aff [0024.354] DeletePrintProcessorA (pName="0", pEnvironment="0", pPrintProcessorName="0") returned 0 [0024.384] GetLastError () returned 0x7b [0024.385] GetCurrentThreadId () returned 0x9ec [0024.385] GetCurrentThreadId () returned 0x9ec [0024.385] GetCurrentThreadId () returned 0x9ec [0024.385] SetWindowTextA (hWnd=0x3015a, lpString="Saberbill8") returned 1 [0024.385] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0xc, wParam=0x0, lParam=0x371fe0) returned 0x1 [0024.385] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f8a8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe")) returned 0x6a [0024.385] lstrcpynA (in: lpString1=0x18f794, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe", iMaxLength=260 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" [0024.385] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe") returned 106 [0024.385] lstrcpyA (in: lpString1=0x37b490, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" [0024.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x37b580, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0024.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x37b580, cbMultiByte=-1, lpWideCharStr=0x5b6d04, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 38 [0024.387] SysStringLen (param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0024.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", cchWideChar=38, lpMultiByteStr=0x5b6d5c, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpUsedDefaultChar=0x0) returned 38 [0024.387] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0024.387] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0xc, wParam=0x0, lParam=0x5b6d5c) returned 0x1 [0024.387] GetWindowLongA (hWnd=0x201c6, nIndex=-16) returned 114229248 [0024.387] GetWindowLongA (hWnd=0x201c6, nIndex=-20) returned 256 [0024.387] GetClientRect (in: hWnd=0x201c6, lpRect=0x18f98c | out: lpRect=0x18f98c) returned 1 [0024.387] MapWindowPoints (in: hWndFrom=0x201c6, hWndTo=0x0, lpPoints=0x18f98c, cPoints=0x2 | out: lpPoints=0x18f98c) returned 18481425 [0024.387] SetWindowLongA (hWnd=0x201c6, nIndex=-16, dwNewLong=114229248) returned 114229248 [0024.387] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x7c, wParam=0xfffffff0, lParam=0x18f918) returned 0x0 [0024.388] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x7d, wParam=0xfffffff0, lParam=0x18f918) returned 0x0 [0024.388] SetWindowLongA (hWnd=0x201c6, nIndex=-20, dwNewLong=256) returned 256 [0024.388] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x7c, wParam=0xffffffec, lParam=0x18f918) returned 0x0 [0024.388] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x7d, wParam=0xffffffec, lParam=0x18f918) returned 0x0 [0024.388] GetClientRect (in: hWnd=0x201c6, lpRect=0x18f954 | out: lpRect=0x18f954) returned 1 [0024.389] MapWindowPoints (in: hWndFrom=0x201c6, hWndTo=0x0, lpPoints=0x18f954, cPoints=0x2 | out: lpPoints=0x18f954) returned 18481425 [0024.389] EqualRect (lprc1=0x18f954, lprc2=0x18f98c) returned 1 [0024.389] GetClientRect (in: hWnd=0x201c6, lpRect=0x18f918 | out: lpRect=0x18f918) returned 1 [0024.389] OleTranslateColor () returned 0x0 [0024.389] OleTranslateColor () returned 0x0 [0024.389] CreateSolidBrush (color=0xff) returned 0x4c1007e8 [0024.389] OleTranslateColor () returned 0x0 [0024.389] OleTranslateColor () returned 0x0 [0024.389] SetTextColor (hdc=0x2a01019b, color=0x0) returned 0x0 [0024.389] SetBkColor (hdc=0x2a01019b, color=0xff) returned 0xf0f0f0 [0024.389] FillRect (hDC=0x2a01019b, lprc=0x18f918, hbr=0x4c1007e8) returned 1 [0024.405] SetTextColor (hdc=0x2a01019b, color=0x0) returned 0x0 [0024.405] SetBkColor (hdc=0x2a01019b, color=0xf0f0f0) returned 0xff [0024.405] OleTranslateColor () returned 0x0 [0024.405] SetBkColor (hdc=0x2a01019b, color=0xff) returned 0xf0f0f0 [0024.405] GetCurrentProcessId () returned 0x9e8 [0024.405] PeekMessageA (in: lpMsg=0x18f97c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f97c) returned 0 [0024.406] GetTickCount () returned 0xe84b [0024.406] GetTickCount () returned 0xe85b [0024.406] GetTickCount () returned 0xe85b [0024.562] CoFreeUnusedLibraries () [0024.562] GetTickCount () returned 0xe8f7 [0024.562] GetTickCount () returned 0xe8f7 [0024.562] IsWindowVisible (hWnd=0x201c6) returned 0 [0024.562] Sleep (dwMilliseconds=0x0) [0024.598] SetWindowPos (hWnd=0x201c6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x13) returned 1 [0024.599] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x46, wParam=0x0, lParam=0x18f57c) returned 0x0 [0024.599] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x46, wParam=0x0, lParam=0x18f57c) returned 0x0 [0024.599] GetWindow (hWnd=0x201c6, uCmd=0x0) returned 0x3013c [0024.599] GetWindow (hWnd=0x3013c, uCmd=0x2) returned 0x3013a [0024.599] GetWindow (hWnd=0x3013a, uCmd=0x2) returned 0x10142 [0024.599] GetWindow (hWnd=0x10142, uCmd=0x2) returned 0x200ce [0024.599] GetWindow (hWnd=0x200ce, uCmd=0x2) returned 0x200e8 [0024.599] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200f8 [0024.599] GetWindow (hWnd=0x200f8, uCmd=0x2) returned 0x200e6 [0024.599] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x1012e [0024.599] GetWindow (hWnd=0x1012e, uCmd=0x2) returned 0x1007c [0024.599] GetWindow (hWnd=0x1007c, uCmd=0x2) returned 0x1007a [0024.599] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10066 [0024.599] GetWindow (hWnd=0x10066, uCmd=0x2) returned 0x10092 [0024.599] GetWindow (hWnd=0x10092, uCmd=0x2) returned 0x10084 [0024.599] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0024.599] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0024.600] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x1005c [0024.600] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x10058 [0024.600] GetWindow (hWnd=0x10058, uCmd=0x2) returned 0x1005e [0024.600] GetWindow (hWnd=0x1005e, uCmd=0x2) returned 0x1005a [0024.600] GetWindow (hWnd=0x1005a, uCmd=0x2) returned 0x10124 [0024.600] GetWindow (hWnd=0x10124, uCmd=0x2) returned 0x10122 [0024.600] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x100f4 [0024.600] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009c [0024.600] GetWindow (hWnd=0x5009c, uCmd=0x2) returned 0x10094 [0024.600] GetWindow (hWnd=0x10094, uCmd=0x2) returned 0x101ba [0024.600] GetWindow (hWnd=0x101ba, uCmd=0x2) returned 0x101b8 [0024.600] GetWindow (hWnd=0x101b8, uCmd=0x2) returned 0x201c2 [0024.600] GetWindow (hWnd=0x201c2, uCmd=0x2) returned 0x201c6 [0024.600] IsWindowVisible (hWnd=0x201c6) returned 0 [0024.600] GetWindow (hWnd=0x201c6, uCmd=0x2) returned 0x50126 [0024.600] GetWindow (hWnd=0x50126, uCmd=0x2) returned 0x3015a [0024.600] GetWindow (hWnd=0x3015a, uCmd=0x2) returned 0x50130 [0024.600] GetWindow (hWnd=0x50130, uCmd=0x2) returned 0x30134 [0024.600] GetWindow (hWnd=0x30134, uCmd=0x2) returned 0x101b6 [0024.600] GetWindow (hWnd=0x101b6, uCmd=0x2) returned 0x101b4 [0024.600] GetWindow (hWnd=0x101b4, uCmd=0x2) returned 0x101b2 [0024.600] GetWindow (hWnd=0x101b2, uCmd=0x2) returned 0x101b0 [0024.600] GetWindow (hWnd=0x101b0, uCmd=0x2) returned 0x101ae [0024.600] GetWindow (hWnd=0x101ae, uCmd=0x2) returned 0x101ac [0024.600] GetWindow (hWnd=0x101ac, uCmd=0x2) returned 0x101aa [0024.600] GetWindow (hWnd=0x101aa, uCmd=0x2) returned 0x101a8 [0024.600] GetWindow (hWnd=0x101a8, uCmd=0x2) returned 0x101a2 [0024.600] GetWindow (hWnd=0x101a2, uCmd=0x2) returned 0x101a6 [0024.601] GetWindow (hWnd=0x101a6, uCmd=0x2) returned 0x101a0 [0024.601] GetWindow (hWnd=0x101a0, uCmd=0x2) returned 0x101a4 [0024.601] GetWindow (hWnd=0x101a4, uCmd=0x2) returned 0x1019c [0024.601] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019e [0024.601] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x10198 [0024.601] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a [0024.601] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194 [0024.601] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196 [0024.601] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190 [0024.601] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192 [0024.601] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c [0024.601] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e [0024.601] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188 [0024.601] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a [0024.601] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184 [0024.601] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186 [0024.601] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180 [0024.601] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x10182 [0024.601] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x1017c [0024.601] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e [0024.601] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178 [0024.601] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x2017a [0024.601] GetWindow (hWnd=0x2017a, uCmd=0x2) returned 0x10174 [0024.601] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176 [0024.602] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170 [0024.602] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172 [0024.602] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c [0024.602] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e [0024.602] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x2016a [0024.602] GetWindow (hWnd=0x2016a, uCmd=0x2) returned 0x20168 [0024.602] GetWindow (hWnd=0x20168, uCmd=0x2) returned 0x1015e [0024.602] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x30156 [0024.602] GetWindow (hWnd=0x30156, uCmd=0x2) returned 0x1014c [0024.602] GetWindow (hWnd=0x1014c, uCmd=0x2) returned 0x1014a [0024.602] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x20140 [0024.602] GetWindow (hWnd=0x20140, uCmd=0x2) returned 0x20024 [0024.602] GetWindow (hWnd=0x20024, uCmd=0x2) returned 0x10136 [0024.602] GetWindow (hWnd=0x10136, uCmd=0x2) returned 0x20028 [0024.602] GetWindow (hWnd=0x20028, uCmd=0x2) returned 0x2001e [0024.602] GetWindow (hWnd=0x2001e, uCmd=0x2) returned 0x2001c [0024.602] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0024.602] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200d2 [0024.602] GetWindow (hWnd=0x200d2, uCmd=0x2) returned 0x200c2 [0024.602] GetWindow (hWnd=0x200c2, uCmd=0x2) returned 0x200b0 [0024.602] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b2 [0024.602] GetWindow (hWnd=0x200b2, uCmd=0x2) returned 0x200b6 [0024.602] GetWindow (hWnd=0x200b6, uCmd=0x2) returned 0x200be [0024.602] GetWindow (hWnd=0x200be, uCmd=0x2) returned 0x300cc [0024.602] GetWindow (hWnd=0x300cc, uCmd=0x2) returned 0x400a0 [0024.603] GetWindow (hWnd=0x400a0, uCmd=0x2) returned 0x10112 [0024.603] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10114 [0024.603] GetWindow (hWnd=0x10114, uCmd=0x2) returned 0x1010a [0024.603] GetWindow (hWnd=0x1010a, uCmd=0x2) returned 0x10110 [0024.603] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x300fe [0024.603] GetWindow (hWnd=0x300fe, uCmd=0x2) returned 0x1010e [0024.603] GetWindow (hWnd=0x1010e, uCmd=0x2) returned 0x10108 [0024.603] GetWindow (hWnd=0x10108, uCmd=0x2) returned 0x10106 [0024.603] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0024.603] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0024.603] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x50096 [0024.603] GetWindow (hWnd=0x50096, uCmd=0x2) returned 0x1008a [0024.603] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x10088 [0024.603] GetWindow (hWnd=0x10088, uCmd=0x2) returned 0x10080 [0024.603] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x1006e [0024.603] GetWindow (hWnd=0x1006e, uCmd=0x2) returned 0x1006a [0024.603] GetWindow (hWnd=0x1006a, uCmd=0x2) returned 0x10056 [0024.603] GetWindow (hWnd=0x10056, uCmd=0x2) returned 0x1004e [0024.603] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x2004a [0024.603] GetWindow (hWnd=0x2004a, uCmd=0x2) returned 0x1004c [0024.603] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x30044 [0024.604] GetWindow (hWnd=0x30044, uCmd=0x2) returned 0x10048 [0024.604] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10046 [0024.604] GetWindow (hWnd=0x10046, uCmd=0x2) returned 0x1011e [0024.604] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x1011c [0024.604] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x100ec [0024.604] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0024.604] GetCurrentProcessId () returned 0x9e8 [0024.604] PeekMessageA (in: lpMsg=0x18f97c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f97c) returned 0 [0024.604] GetTickCount () returned 0xe916 [0024.604] GetTickCount () returned 0xe916 [0024.604] GetTickCount () returned 0xe916 [0024.604] GetTickCount () returned 0xe916 [0024.604] IsWindowVisible (hWnd=0x201c6) returned 0 [0024.604] Sleep (dwMilliseconds=0x0) [0024.619] IsWindowVisible (hWnd=0x201c6) returned 0 [0024.619] ShowWindow (hWnd=0x201c6, nCmdShow=0) returned 0 [0030.924] SetErrorMode (uMode=0x8001) returned 0x8001 [0030.924] LoadLibraryA (lpLibFileName="user32") returned 0x75120000 [0030.925] SetErrorMode (uMode=0x8001) returned 0x8001 [0030.925] GetProcAddress (hModule=0x75120000, lpProcName="CreateWindowExA") returned 0x7513d22e [0030.925] CreateWindowExA (dwExStyle=0x80, lpClassName="STATIC", lpWindowName="çSÌ¥\x92Ë\x1fhÑ\x94Ã7\x1e¯¸X ²B", dwStyle=0x0, X=1488498462, Y=935564497, nWidth=1746914194, nHeight=-1513335833, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x301d0 [0030.926] SetErrorMode (uMode=0x8001) returned 0x8001 [0030.926] LoadLibraryA (lpLibFileName="user32") returned 0x75120000 [0030.926] SetErrorMode (uMode=0x8001) returned 0x8001 [0030.926] GetProcAddress (hModule=0x75120000, lpProcName="ShowWindow") returned 0x75140dfb [0030.926] ShowWindow (hWnd=0x301d0, nCmdShow=1) returned 0 [0030.927] GetWindowLongA (hWnd=0x201c2, nIndex=0) returned 3547292 [0030.927] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0030.927] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0030.975] SetErrorMode (uMode=0x8001) returned 0x8001 [0030.975] LoadLibraryA (lpLibFileName="Msvbvm60.dll") returned 0x72940000 [0030.975] SetErrorMode (uMode=0x8001) returned 0x8001 [0030.976] GetProcAddress (hModule=0x72940000, lpProcName="rtcDoEvents") returned 0x72a0e0f7 [0030.976] GetCurrentProcessId () returned 0x9e8 [0030.976] PeekMessageA (in: lpMsg=0x18f8a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8a8) returned 1 [0030.976] IsWindow (hWnd=0x201c2) returned 1 [0030.976] GetWindowLongA (hWnd=0x201c2, nIndex=-16) returned -2080374784 [0030.976] GetParent (hWnd=0x201c2) returned 0x0 [0030.976] TranslateMessage (lpMsg=0x18f8a8) returned 0 [0030.976] DispatchMessageA (lpMsg=0x18f8a8) returned 0x0 [0030.976] NtdllDefWindowProc_A (hWnd=0x201c2, Msg=0x1e, wParam=0x0, lParam=0x0) returned 0x0 [0030.976] PeekMessageA (in: lpMsg=0x18f824, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18f824) returned 1 [0030.976] PeekMessageA (in: lpMsg=0x18f8a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8a8) returned 1 [0030.976] IsWindow (hWnd=0x201c6) returned 1 [0030.976] GetWindowLongA (hWnd=0x201c6, nIndex=-16) returned 114229248 [0030.976] IsIconic (hWnd=0x201c6) returned 0 [0030.976] GetParent (hWnd=0x201c6) returned 0x0 [0030.976] TranslateMessage (lpMsg=0x18f8a8) returned 0 [0030.976] DispatchMessageA (lpMsg=0x18f8a8) returned 0x0 [0030.976] NtdllDefWindowProc_A (hWnd=0x201c6, Msg=0x1e, wParam=0x0, lParam=0x0) returned 0x0 [0030.976] PeekMessageA (in: lpMsg=0x18f824, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18f824) returned 1 [0030.976] PeekMessageA (in: lpMsg=0x18f8a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8a8) returned 1 [0030.976] IsWindow (hWnd=0x50126) returned 1 [0030.976] GetWindowLongA (hWnd=0x50126, nIndex=-16) returned -1946157056 [0030.976] GetParent (hWnd=0x50126) returned 0x301d0 [0030.976] TranslateMessage (lpMsg=0x18f8a8) returned 0 [0030.976] DispatchMessageA (lpMsg=0x18f8a8) returned 0x0 [0030.976] PeekMessageA (in: lpMsg=0x18f824, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18f824) returned 1 [0030.976] PeekMessageA (in: lpMsg=0x18f8a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8a8) returned 1 [0030.977] IsWindow (hWnd=0x3015a) returned 1 [0030.977] GetWindowLongA (hWnd=0x3015a, nIndex=-16) returned -1811349504 [0030.977] GetParent (hWnd=0x3015a) returned 0x0 [0030.977] TranslateMessage (lpMsg=0x18f8a8) returned 0 [0030.977] DispatchMessageA (lpMsg=0x18f8a8) returned 0x0 [0030.977] NtdllDefWindowProc_A (hWnd=0x3015a, Msg=0x1e, wParam=0x0, lParam=0x0) returned 0x0 [0030.977] PeekMessageA (in: lpMsg=0x18f824, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18f824) returned 1 [0030.977] PeekMessageA (in: lpMsg=0x18f8a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8a8) returned 1 [0030.977] TranslateMessage (lpMsg=0x18f8a8) returned 0 [0030.977] DispatchMessageA (lpMsg=0x18f8a8) returned 0x0 [0030.977] PeekMessageA (in: lpMsg=0x18f824, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18f824) returned 0 [0030.977] GetTickCount () returned 0x10202 [0030.977] IsWindowVisible (hWnd=0x201c6) returned 0 [0030.977] Sleep (dwMilliseconds=0x0) [0030.977] SetErrorMode (uMode=0x8001) returned 0x8001 [0030.977] LoadLibraryA (lpLibFileName="user32") returned 0x75120000 [0030.977] SetErrorMode (uMode=0x8001) returned 0x8001 [0030.977] GetProcAddress (hModule=0x75120000, lpProcName="EnumWindows") returned 0x7513d1cf [0030.977] EnumWindows (lpEnumFunc=0x42b8e9, lParam=0x18f974) returned 1 [0030.979] SetErrorMode (uMode=0x8001) returned 0x8001 [0030.979] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0030.979] SetErrorMode (uMode=0x8001) returned 0x8001 [0030.979] GetProcAddress (hModule=0x765b0000, lpProcName="VirtualAlloc") returned 0x765c1856 [0030.979] VirtualAlloc (lpAddress=0x0, dwSize=0x8300, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0040.267] SetErrorMode (uMode=0x8001) returned 0x8001 [0040.267] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0040.267] SetErrorMode (uMode=0x8001) returned 0x8001 [0040.267] GetProcAddress (hModule=0x765b0000, lpProcName="GetTickCount") returned 0x765c110c [0040.267] SetErrorMode (uMode=0x8001) returned 0x8001 [0040.267] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0040.267] SetErrorMode (uMode=0x8001) returned 0x8001 [0040.268] GetProcAddress (hModule=0x765b0000, lpProcName="Sleep") returned 0x765c10ff [0040.268] GetTickCount () returned 0x12635 [0040.268] Sleep (dwMilliseconds=0x7d0) [0042.268] GetTickCount () returned 0x12e11 [0042.268] SetErrorMode (uMode=0x8001) returned 0x8001 [0042.268] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0042.268] SetErrorMode (uMode=0x8001) returned 0x8001 [0042.268] GetProcAddress (hModule=0x765b0000, lpProcName="SetErrorMode") returned 0x765c1b00 [0042.269] SetErrorMode (uMode=0x800) returned 0x8001 [0042.269] SetErrorMode (uMode=0x0) returned 0x800 [0042.269] SetErrorMode (uMode=0x8001) returned 0x0 [0042.269] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0042.269] SetErrorMode (uMode=0x0) returned 0x8001 [0042.269] GetProcAddress (hModule=0x765b0000, lpProcName="SetLastError") returned 0x765c11a9 [0042.269] SetLastError (dwErrCode=0x5) [0042.269] SetErrorMode (uMode=0x8001) returned 0x0 [0042.269] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0042.269] SetErrorMode (uMode=0x0) returned 0x8001 [0042.269] GetProcAddress (hModule=0x765b0000, lpProcName="VirtualAllocEx") returned 0x765dd9b0 [0042.269] VirtualAllocEx (hProcess=0xffffffff, lpAddress=0x0, dwSize=0x4000000, flAllocationType=0x3000, flProtect=0x40) returned 0x3470000 [0042.271] SetErrorMode (uMode=0x8001) returned 0x0 [0042.271] LoadLibraryA (lpLibFileName="user32") returned 0x75120000 [0042.271] SetErrorMode (uMode=0x0) returned 0x8001 [0042.271] GetProcAddress (hModule=0x75120000, lpProcName="GetCursorPos") returned 0x75141218 [0042.271] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.271] Sleep (dwMilliseconds=0x1) [0042.283] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.283] Sleep (dwMilliseconds=0x1) [0042.299] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.299] Sleep (dwMilliseconds=0x1) [0042.315] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.315] Sleep (dwMilliseconds=0x1) [0042.330] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.330] Sleep (dwMilliseconds=0x1) [0042.346] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.346] Sleep (dwMilliseconds=0x1) [0042.362] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.362] Sleep (dwMilliseconds=0x1) [0042.377] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.377] Sleep (dwMilliseconds=0x1) [0042.393] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.393] Sleep (dwMilliseconds=0x1) [0042.408] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.408] Sleep (dwMilliseconds=0x1) [0042.424] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.424] Sleep (dwMilliseconds=0x1) [0042.439] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.439] Sleep (dwMilliseconds=0x1) [0042.455] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.455] Sleep (dwMilliseconds=0x1) [0042.471] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.471] Sleep (dwMilliseconds=0x1) [0042.487] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.487] Sleep (dwMilliseconds=0x1) [0042.502] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.502] Sleep (dwMilliseconds=0x1) [0042.518] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.518] Sleep (dwMilliseconds=0x1) [0042.533] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.533] Sleep (dwMilliseconds=0x1) [0042.549] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.549] Sleep (dwMilliseconds=0x1) [0042.564] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.564] Sleep (dwMilliseconds=0x1) [0042.580] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.580] Sleep (dwMilliseconds=0x1) [0042.595] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.595] Sleep (dwMilliseconds=0x1) [0042.611] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.611] Sleep (dwMilliseconds=0x1) [0042.627] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.627] Sleep (dwMilliseconds=0x1) [0042.642] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.642] Sleep (dwMilliseconds=0x1) [0042.658] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.658] Sleep (dwMilliseconds=0x1) [0042.674] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.674] Sleep (dwMilliseconds=0x1) [0042.689] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.689] Sleep (dwMilliseconds=0x1) [0042.705] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.705] Sleep (dwMilliseconds=0x1) [0042.720] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.720] Sleep (dwMilliseconds=0x1) [0042.736] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.736] Sleep (dwMilliseconds=0x1) [0042.751] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.752] Sleep (dwMilliseconds=0x1) [0042.767] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.767] Sleep (dwMilliseconds=0x1) [0042.783] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.783] Sleep (dwMilliseconds=0x1) [0042.799] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.799] Sleep (dwMilliseconds=0x1) [0042.814] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.814] Sleep (dwMilliseconds=0x1) [0042.829] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.829] Sleep (dwMilliseconds=0x1) [0042.845] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.845] Sleep (dwMilliseconds=0x1) [0042.860] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.861] Sleep (dwMilliseconds=0x1) [0042.876] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.876] Sleep (dwMilliseconds=0x1) [0042.892] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.892] Sleep (dwMilliseconds=0x1) [0042.908] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.908] Sleep (dwMilliseconds=0x1) [0042.923] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.923] Sleep (dwMilliseconds=0x1) [0042.941] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.941] Sleep (dwMilliseconds=0x1) [0042.954] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.954] Sleep (dwMilliseconds=0x1) [0042.970] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.970] Sleep (dwMilliseconds=0x1) [0042.985] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0042.985] Sleep (dwMilliseconds=0x1) [0043.001] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.001] Sleep (dwMilliseconds=0x1) [0043.017] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.017] Sleep (dwMilliseconds=0x1) [0043.032] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.032] Sleep (dwMilliseconds=0x1) [0043.048] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.048] Sleep (dwMilliseconds=0x1) [0043.063] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.064] Sleep (dwMilliseconds=0x1) [0043.079] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.079] Sleep (dwMilliseconds=0x1) [0043.095] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.095] Sleep (dwMilliseconds=0x1) [0043.111] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.116] Sleep (dwMilliseconds=0x1) [0043.126] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.126] Sleep (dwMilliseconds=0x1) [0043.141] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.141] Sleep (dwMilliseconds=0x1) [0043.157] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.157] Sleep (dwMilliseconds=0x1) [0043.173] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.173] Sleep (dwMilliseconds=0x1) [0043.188] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.188] Sleep (dwMilliseconds=0x1) [0043.204] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.204] Sleep (dwMilliseconds=0x1) [0043.219] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.219] Sleep (dwMilliseconds=0x1) [0043.235] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.235] Sleep (dwMilliseconds=0x1) [0043.253] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.253] Sleep (dwMilliseconds=0x1) [0043.266] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.266] Sleep (dwMilliseconds=0x1) [0043.282] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.282] Sleep (dwMilliseconds=0x1) [0043.297] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.297] Sleep (dwMilliseconds=0x1) [0043.313] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.313] Sleep (dwMilliseconds=0x1) [0043.329] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.329] Sleep (dwMilliseconds=0x1) [0043.344] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.344] Sleep (dwMilliseconds=0x1) [0043.360] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.360] Sleep (dwMilliseconds=0x1) [0043.376] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.376] Sleep (dwMilliseconds=0x1) [0043.391] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.391] Sleep (dwMilliseconds=0x1) [0043.407] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.407] Sleep (dwMilliseconds=0x1) [0043.422] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.422] Sleep (dwMilliseconds=0x1) [0043.438] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.438] Sleep (dwMilliseconds=0x1) [0043.453] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.453] Sleep (dwMilliseconds=0x1) [0043.469] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.469] Sleep (dwMilliseconds=0x1) [0043.485] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.485] Sleep (dwMilliseconds=0x1) [0043.500] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.500] Sleep (dwMilliseconds=0x1) [0043.517] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.517] Sleep (dwMilliseconds=0x1) [0043.531] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.531] Sleep (dwMilliseconds=0x1) [0043.547] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.547] Sleep (dwMilliseconds=0x1) [0043.563] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.563] Sleep (dwMilliseconds=0x1) [0043.578] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.578] Sleep (dwMilliseconds=0x1) [0043.594] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.594] Sleep (dwMilliseconds=0x1) [0043.609] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.609] Sleep (dwMilliseconds=0x1) [0043.625] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.625] Sleep (dwMilliseconds=0x1) [0043.641] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.641] Sleep (dwMilliseconds=0x1) [0043.656] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.656] Sleep (dwMilliseconds=0x1) [0043.672] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.672] Sleep (dwMilliseconds=0x1) [0043.688] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.688] Sleep (dwMilliseconds=0x1) [0043.703] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.703] Sleep (dwMilliseconds=0x1) [0043.719] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.719] Sleep (dwMilliseconds=0x1) [0043.734] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.734] Sleep (dwMilliseconds=0x1) [0043.750] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.750] Sleep (dwMilliseconds=0x1) [0043.765] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.765] Sleep (dwMilliseconds=0x1) [0043.781] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.781] Sleep (dwMilliseconds=0x1) [0043.797] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.797] Sleep (dwMilliseconds=0x1) [0043.813] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.813] Sleep (dwMilliseconds=0x1) [0043.828] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.828] Sleep (dwMilliseconds=0x1) [0043.843] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.843] Sleep (dwMilliseconds=0x1) [0043.859] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.859] Sleep (dwMilliseconds=0x1) [0043.875] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.875] Sleep (dwMilliseconds=0x1) [0043.890] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.890] Sleep (dwMilliseconds=0x1) [0043.906] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.906] Sleep (dwMilliseconds=0x1) [0043.921] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.921] Sleep (dwMilliseconds=0x1) [0043.942] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.942] Sleep (dwMilliseconds=0x1) [0043.953] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.953] Sleep (dwMilliseconds=0x1) [0043.973] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.973] Sleep (dwMilliseconds=0x1) [0043.984] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.984] Sleep (dwMilliseconds=0x1) [0043.999] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0043.999] Sleep (dwMilliseconds=0x1) [0044.015] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.015] Sleep (dwMilliseconds=0x1) [0044.031] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.031] Sleep (dwMilliseconds=0x1) [0044.047] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.047] Sleep (dwMilliseconds=0x1) [0044.062] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.062] Sleep (dwMilliseconds=0x1) [0044.077] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.077] Sleep (dwMilliseconds=0x1) [0044.094] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.094] Sleep (dwMilliseconds=0x1) [0044.109] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.109] Sleep (dwMilliseconds=0x1) [0044.124] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.124] Sleep (dwMilliseconds=0x1) [0044.140] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.140] Sleep (dwMilliseconds=0x1) [0044.156] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.156] Sleep (dwMilliseconds=0x1) [0044.171] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.171] Sleep (dwMilliseconds=0x1) [0044.187] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.187] Sleep (dwMilliseconds=0x1) [0044.202] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.202] Sleep (dwMilliseconds=0x1) [0044.218] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.218] Sleep (dwMilliseconds=0x1) [0044.233] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.233] Sleep (dwMilliseconds=0x1) [0044.249] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.249] Sleep (dwMilliseconds=0x1) [0044.265] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.265] Sleep (dwMilliseconds=0x1) [0044.280] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.281] Sleep (dwMilliseconds=0x1) [0044.296] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.296] Sleep (dwMilliseconds=0x1) [0044.311] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.311] Sleep (dwMilliseconds=0x1) [0044.327] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.327] Sleep (dwMilliseconds=0x1) [0044.343] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.343] Sleep (dwMilliseconds=0x1) [0044.359] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.359] Sleep (dwMilliseconds=0x1) [0044.374] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.374] Sleep (dwMilliseconds=0x1) [0044.389] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.389] Sleep (dwMilliseconds=0x1) [0044.405] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.405] Sleep (dwMilliseconds=0x1) [0044.421] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.421] Sleep (dwMilliseconds=0x1) [0044.436] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.436] Sleep (dwMilliseconds=0x1) [0044.452] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.452] Sleep (dwMilliseconds=0x1) [0044.468] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.468] Sleep (dwMilliseconds=0x1) [0044.483] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.483] Sleep (dwMilliseconds=0x1) [0044.499] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.499] Sleep (dwMilliseconds=0x1) [0044.514] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.514] Sleep (dwMilliseconds=0x1) [0044.530] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.530] Sleep (dwMilliseconds=0x1) [0044.545] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.545] Sleep (dwMilliseconds=0x1) [0044.561] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.561] Sleep (dwMilliseconds=0x1) [0044.577] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.577] Sleep (dwMilliseconds=0x1) [0044.592] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.592] Sleep (dwMilliseconds=0x1) [0044.608] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.608] Sleep (dwMilliseconds=0x1) [0044.623] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.624] Sleep (dwMilliseconds=0x1) [0044.639] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.639] Sleep (dwMilliseconds=0x1) [0044.655] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.655] Sleep (dwMilliseconds=0x1) [0044.670] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.670] Sleep (dwMilliseconds=0x1) [0044.686] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.686] Sleep (dwMilliseconds=0x1) [0044.701] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.701] Sleep (dwMilliseconds=0x1) [0044.717] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.717] Sleep (dwMilliseconds=0x1) [0044.733] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.733] Sleep (dwMilliseconds=0x1) [0044.750] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.750] Sleep (dwMilliseconds=0x1) [0044.765] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.765] Sleep (dwMilliseconds=0x1) [0044.779] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.779] Sleep (dwMilliseconds=0x1) [0044.795] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.795] Sleep (dwMilliseconds=0x1) [0044.811] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.811] Sleep (dwMilliseconds=0x1) [0044.826] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.826] Sleep (dwMilliseconds=0x1) [0044.842] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.842] Sleep (dwMilliseconds=0x1) [0044.857] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.857] Sleep (dwMilliseconds=0x1) [0044.873] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.873] Sleep (dwMilliseconds=0x1) [0044.889] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.889] Sleep (dwMilliseconds=0x1) [0044.904] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.904] Sleep (dwMilliseconds=0x1) [0044.920] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.920] Sleep (dwMilliseconds=0x1) [0044.940] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.940] Sleep (dwMilliseconds=0x1) [0044.951] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.951] Sleep (dwMilliseconds=0x1) [0044.967] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.967] Sleep (dwMilliseconds=0x1) [0044.982] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0044.982] Sleep (dwMilliseconds=0x1) [0045.000] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.001] Sleep (dwMilliseconds=0x1) [0045.014] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.014] Sleep (dwMilliseconds=0x1) [0045.030] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.030] Sleep (dwMilliseconds=0x1) [0045.045] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.045] Sleep (dwMilliseconds=0x1) [0045.060] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.060] Sleep (dwMilliseconds=0x1) [0045.076] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.076] Sleep (dwMilliseconds=0x1) [0045.091] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.091] Sleep (dwMilliseconds=0x1) [0045.107] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.107] Sleep (dwMilliseconds=0x1) [0045.123] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.123] Sleep (dwMilliseconds=0x1) [0045.145] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.145] Sleep (dwMilliseconds=0x1) [0045.154] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.154] Sleep (dwMilliseconds=0x1) [0045.169] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.169] Sleep (dwMilliseconds=0x1) [0045.185] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.185] Sleep (dwMilliseconds=0x1) [0045.201] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.201] Sleep (dwMilliseconds=0x1) [0045.216] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.216] Sleep (dwMilliseconds=0x1) [0045.232] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.232] Sleep (dwMilliseconds=0x1) [0045.247] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.248] Sleep (dwMilliseconds=0x1) [0045.263] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.263] Sleep (dwMilliseconds=0x1) [0045.279] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.279] Sleep (dwMilliseconds=0x1) [0045.294] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.294] Sleep (dwMilliseconds=0x1) [0045.310] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.310] Sleep (dwMilliseconds=0x1) [0045.325] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.326] Sleep (dwMilliseconds=0x1) [0045.341] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.341] Sleep (dwMilliseconds=0x1) [0045.357] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.357] Sleep (dwMilliseconds=0x1) [0045.376] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.376] Sleep (dwMilliseconds=0x1) [0045.391] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.391] Sleep (dwMilliseconds=0x1) [0045.404] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.404] Sleep (dwMilliseconds=0x1) [0045.420] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.420] Sleep (dwMilliseconds=0x1) [0045.437] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.437] Sleep (dwMilliseconds=0x1) [0045.452] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.452] Sleep (dwMilliseconds=0x1) [0045.467] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.467] Sleep (dwMilliseconds=0x1) [0045.481] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.482] Sleep (dwMilliseconds=0x1) [0045.497] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.497] Sleep (dwMilliseconds=0x1) [0045.513] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.513] Sleep (dwMilliseconds=0x1) [0045.529] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.529] Sleep (dwMilliseconds=0x1) [0045.544] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.544] Sleep (dwMilliseconds=0x1) [0045.559] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.560] Sleep (dwMilliseconds=0x1) [0045.575] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.575] Sleep (dwMilliseconds=0x1) [0045.591] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.591] Sleep (dwMilliseconds=0x1) [0045.606] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.606] Sleep (dwMilliseconds=0x1) [0045.622] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.622] Sleep (dwMilliseconds=0x1) [0045.637] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.637] Sleep (dwMilliseconds=0x1) [0045.653] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.653] Sleep (dwMilliseconds=0x1) [0045.669] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.669] Sleep (dwMilliseconds=0x1) [0045.689] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.689] Sleep (dwMilliseconds=0x1) [0045.700] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.700] Sleep (dwMilliseconds=0x1) [0045.715] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.715] Sleep (dwMilliseconds=0x1) [0045.731] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.731] Sleep (dwMilliseconds=0x1) [0045.747] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.747] Sleep (dwMilliseconds=0x1) [0045.762] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.762] Sleep (dwMilliseconds=0x1) [0045.778] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.778] Sleep (dwMilliseconds=0x1) [0045.793] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.793] Sleep (dwMilliseconds=0x1) [0045.810] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.810] Sleep (dwMilliseconds=0x1) [0045.825] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.825] Sleep (dwMilliseconds=0x1) [0045.840] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.840] Sleep (dwMilliseconds=0x1) [0045.859] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.859] Sleep (dwMilliseconds=0x1) [0045.871] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.871] Sleep (dwMilliseconds=0x1) [0045.887] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.887] Sleep (dwMilliseconds=0x1) [0045.903] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.903] Sleep (dwMilliseconds=0x1) [0045.919] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.919] Sleep (dwMilliseconds=0x1) [0045.949] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.949] Sleep (dwMilliseconds=0x1) [0045.965] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.966] Sleep (dwMilliseconds=0x1) [0045.981] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.981] Sleep (dwMilliseconds=0x1) [0045.998] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0045.998] Sleep (dwMilliseconds=0x1) [0046.013] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.013] Sleep (dwMilliseconds=0x1) [0046.027] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.027] Sleep (dwMilliseconds=0x1) [0046.044] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.044] Sleep (dwMilliseconds=0x1) [0046.060] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.060] Sleep (dwMilliseconds=0x1) [0046.074] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.074] Sleep (dwMilliseconds=0x1) [0046.090] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.090] Sleep (dwMilliseconds=0x1) [0046.106] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.106] Sleep (dwMilliseconds=0x1) [0046.123] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.123] Sleep (dwMilliseconds=0x1) [0046.137] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.137] Sleep (dwMilliseconds=0x1) [0046.165] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.165] Sleep (dwMilliseconds=0x1) [0046.168] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.168] Sleep (dwMilliseconds=0x1) [0046.188] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.188] Sleep (dwMilliseconds=0x1) [0046.199] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.199] Sleep (dwMilliseconds=0x1) [0046.216] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.216] Sleep (dwMilliseconds=0x1) [0046.231] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.231] Sleep (dwMilliseconds=0x1) [0046.246] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.246] Sleep (dwMilliseconds=0x1) [0046.261] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.262] Sleep (dwMilliseconds=0x1) [0046.277] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.278] Sleep (dwMilliseconds=0x1) [0046.293] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.293] Sleep (dwMilliseconds=0x1) [0046.308] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.308] Sleep (dwMilliseconds=0x1) [0046.324] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.324] Sleep (dwMilliseconds=0x1) [0046.339] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.339] Sleep (dwMilliseconds=0x1) [0046.355] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.355] Sleep (dwMilliseconds=0x1) [0046.371] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.371] Sleep (dwMilliseconds=0x1) [0046.386] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.386] Sleep (dwMilliseconds=0x1) [0046.402] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.402] Sleep (dwMilliseconds=0x1) [0046.418] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.418] Sleep (dwMilliseconds=0x1) [0046.433] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.433] Sleep (dwMilliseconds=0x1) [0046.449] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.449] Sleep (dwMilliseconds=0x1) [0046.464] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.464] Sleep (dwMilliseconds=0x1) [0046.480] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.480] Sleep (dwMilliseconds=0x1) [0046.495] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.496] Sleep (dwMilliseconds=0x1) [0046.511] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.511] Sleep (dwMilliseconds=0x1) [0046.527] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.527] Sleep (dwMilliseconds=0x1) [0046.542] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.542] Sleep (dwMilliseconds=0x1) [0046.558] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.558] Sleep (dwMilliseconds=0x1) [0046.573] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.573] Sleep (dwMilliseconds=0x1) [0046.589] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.589] Sleep (dwMilliseconds=0x1) [0046.605] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.605] Sleep (dwMilliseconds=0x1) [0046.620] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.620] Sleep (dwMilliseconds=0x1) [0046.636] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.636] Sleep (dwMilliseconds=0x1) [0046.651] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.651] Sleep (dwMilliseconds=0x1) [0046.667] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.667] Sleep (dwMilliseconds=0x1) [0046.683] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.683] Sleep (dwMilliseconds=0x1) [0046.698] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.698] Sleep (dwMilliseconds=0x1) [0046.714] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.714] Sleep (dwMilliseconds=0x1) [0046.729] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.729] Sleep (dwMilliseconds=0x1) [0046.745] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.745] Sleep (dwMilliseconds=0x1) [0046.761] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.761] Sleep (dwMilliseconds=0x1) [0046.776] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.776] Sleep (dwMilliseconds=0x1) [0046.792] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.792] Sleep (dwMilliseconds=0x1) [0046.807] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.807] Sleep (dwMilliseconds=0x1) [0046.829] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.829] Sleep (dwMilliseconds=0x1) [0046.842] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.842] Sleep (dwMilliseconds=0x1) [0046.857] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.857] Sleep (dwMilliseconds=0x1) [0046.872] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.872] Sleep (dwMilliseconds=0x1) [0046.885] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.885] Sleep (dwMilliseconds=0x1) [0046.901] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.901] Sleep (dwMilliseconds=0x1) [0046.917] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.917] Sleep (dwMilliseconds=0x1) [0046.935] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.935] Sleep (dwMilliseconds=0x1) [0046.948] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.948] Sleep (dwMilliseconds=0x1) [0046.963] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.963] Sleep (dwMilliseconds=0x1) [0046.979] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.979] Sleep (dwMilliseconds=0x1) [0046.995] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0046.995] Sleep (dwMilliseconds=0x1) [0047.010] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.010] Sleep (dwMilliseconds=0x1) [0047.026] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.026] Sleep (dwMilliseconds=0x1) [0047.041] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.041] Sleep (dwMilliseconds=0x1) [0047.057] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.057] Sleep (dwMilliseconds=0x1) [0047.073] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.073] Sleep (dwMilliseconds=0x1) [0047.088] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.088] Sleep (dwMilliseconds=0x1) [0047.104] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.104] Sleep (dwMilliseconds=0x1) [0047.119] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.119] Sleep (dwMilliseconds=0x1) [0047.135] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.136] Sleep (dwMilliseconds=0x1) [0047.151] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.151] Sleep (dwMilliseconds=0x1) [0047.170] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.170] Sleep (dwMilliseconds=0x1) [0047.198] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.198] Sleep (dwMilliseconds=0x1) [0047.213] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.214] Sleep (dwMilliseconds=0x1) [0047.235] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.236] Sleep (dwMilliseconds=0x1) [0047.244] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.245] Sleep (dwMilliseconds=0x1) [0047.260] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.260] Sleep (dwMilliseconds=0x1) [0047.275] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.275] Sleep (dwMilliseconds=0x1) [0047.291] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.291] Sleep (dwMilliseconds=0x1) [0047.307] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.307] Sleep (dwMilliseconds=0x1) [0047.322] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.322] Sleep (dwMilliseconds=0x1) [0047.338] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.338] Sleep (dwMilliseconds=0x1) [0047.353] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.353] Sleep (dwMilliseconds=0x1) [0047.369] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.369] Sleep (dwMilliseconds=0x1) [0047.385] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.385] Sleep (dwMilliseconds=0x1) [0047.400] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.400] Sleep (dwMilliseconds=0x1) [0047.416] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.416] Sleep (dwMilliseconds=0x1) [0047.431] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.431] Sleep (dwMilliseconds=0x1) [0047.447] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.447] Sleep (dwMilliseconds=0x1) [0047.463] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.463] Sleep (dwMilliseconds=0x1) [0047.478] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.478] Sleep (dwMilliseconds=0x1) [0047.494] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.494] Sleep (dwMilliseconds=0x1) [0047.510] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.510] Sleep (dwMilliseconds=0x1) [0047.525] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.525] Sleep (dwMilliseconds=0x1) [0047.541] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.541] Sleep (dwMilliseconds=0x1) [0047.557] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.557] Sleep (dwMilliseconds=0x1) [0047.572] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.572] Sleep (dwMilliseconds=0x1) [0047.587] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.587] Sleep (dwMilliseconds=0x1) [0047.603] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.603] Sleep (dwMilliseconds=0x1) [0047.619] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.619] Sleep (dwMilliseconds=0x1) [0047.634] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.634] Sleep (dwMilliseconds=0x1) [0047.650] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.650] Sleep (dwMilliseconds=0x1) [0047.665] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.665] Sleep (dwMilliseconds=0x1) [0047.681] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.681] Sleep (dwMilliseconds=0x1) [0047.697] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.697] Sleep (dwMilliseconds=0x1) [0047.712] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.712] Sleep (dwMilliseconds=0x1) [0047.728] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.728] Sleep (dwMilliseconds=0x1) [0047.743] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.743] Sleep (dwMilliseconds=0x1) [0047.759] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.759] Sleep (dwMilliseconds=0x1) [0047.775] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.775] Sleep (dwMilliseconds=0x1) [0047.790] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.790] Sleep (dwMilliseconds=0x1) [0047.806] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.806] Sleep (dwMilliseconds=0x1) [0047.821] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.821] Sleep (dwMilliseconds=0x1) [0047.837] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.837] Sleep (dwMilliseconds=0x1) [0047.853] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.853] Sleep (dwMilliseconds=0x1) [0047.868] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.868] Sleep (dwMilliseconds=0x1) [0047.884] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.884] Sleep (dwMilliseconds=0x1) [0047.899] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.899] Sleep (dwMilliseconds=0x1) [0047.915] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.915] Sleep (dwMilliseconds=0x1) [0047.934] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.934] Sleep (dwMilliseconds=0x1) [0047.947] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.947] Sleep (dwMilliseconds=0x1) [0047.964] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.964] Sleep (dwMilliseconds=0x1) [0047.979] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.979] Sleep (dwMilliseconds=0x1) [0047.993] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0047.993] Sleep (dwMilliseconds=0x1) [0048.009] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.009] Sleep (dwMilliseconds=0x1) [0048.024] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.024] Sleep (dwMilliseconds=0x1) [0048.040] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.040] Sleep (dwMilliseconds=0x1) [0048.060] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.060] Sleep (dwMilliseconds=0x1) [0048.071] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.071] Sleep (dwMilliseconds=0x1) [0048.087] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.087] Sleep (dwMilliseconds=0x1) [0048.102] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.102] Sleep (dwMilliseconds=0x1) [0048.123] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.123] Sleep (dwMilliseconds=0x1) [0048.133] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.133] Sleep (dwMilliseconds=0x1) [0048.149] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.149] Sleep (dwMilliseconds=0x1) [0048.165] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.165] Sleep (dwMilliseconds=0x1) [0048.180] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.180] Sleep (dwMilliseconds=0x1) [0048.196] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.196] Sleep (dwMilliseconds=0x1) [0048.211] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.211] Sleep (dwMilliseconds=0x1) [0048.227] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.227] Sleep (dwMilliseconds=0x1) [0048.243] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.243] Sleep (dwMilliseconds=0x1) [0048.258] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.258] Sleep (dwMilliseconds=0x1) [0048.274] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.274] Sleep (dwMilliseconds=0x1) [0048.290] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.290] Sleep (dwMilliseconds=0x1) [0048.305] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.305] Sleep (dwMilliseconds=0x1) [0048.321] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.321] Sleep (dwMilliseconds=0x1) [0048.338] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.338] Sleep (dwMilliseconds=0x1) [0048.352] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.352] Sleep (dwMilliseconds=0x1) [0048.367] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.367] Sleep (dwMilliseconds=0x1) [0048.383] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.383] Sleep (dwMilliseconds=0x1) [0048.399] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.399] Sleep (dwMilliseconds=0x1) [0048.414] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.414] Sleep (dwMilliseconds=0x1) [0048.430] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.430] Sleep (dwMilliseconds=0x1) [0048.446] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.446] Sleep (dwMilliseconds=0x1) [0048.461] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.461] Sleep (dwMilliseconds=0x1) [0048.477] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.477] Sleep (dwMilliseconds=0x1) [0048.492] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.492] Sleep (dwMilliseconds=0x1) [0048.508] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.508] Sleep (dwMilliseconds=0x1) [0048.523] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.523] Sleep (dwMilliseconds=0x1) [0048.541] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.541] Sleep (dwMilliseconds=0x1) [0048.555] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.555] Sleep (dwMilliseconds=0x1) [0048.570] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.570] Sleep (dwMilliseconds=0x1) [0048.586] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.586] Sleep (dwMilliseconds=0x1) [0048.601] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.601] Sleep (dwMilliseconds=0x1) [0048.617] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.617] Sleep (dwMilliseconds=0x1) [0048.633] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.633] Sleep (dwMilliseconds=0x1) [0048.648] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.648] Sleep (dwMilliseconds=0x1) [0048.664] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.664] Sleep (dwMilliseconds=0x1) [0048.679] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.679] Sleep (dwMilliseconds=0x1) [0048.695] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.695] Sleep (dwMilliseconds=0x1) [0048.711] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.711] Sleep (dwMilliseconds=0x1) [0048.726] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.726] Sleep (dwMilliseconds=0x1) [0048.742] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.742] Sleep (dwMilliseconds=0x1) [0048.758] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.758] Sleep (dwMilliseconds=0x1) [0048.773] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.773] Sleep (dwMilliseconds=0x1) [0048.789] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.789] Sleep (dwMilliseconds=0x1) [0048.804] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.804] Sleep (dwMilliseconds=0x1) [0048.820] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.820] Sleep (dwMilliseconds=0x1) [0048.836] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.836] Sleep (dwMilliseconds=0x1) [0048.852] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.852] Sleep (dwMilliseconds=0x1) [0048.867] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.867] Sleep (dwMilliseconds=0x1) [0048.882] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.882] Sleep (dwMilliseconds=0x1) [0048.898] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.898] Sleep (dwMilliseconds=0x1) [0048.913] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.913] Sleep (dwMilliseconds=0x1) [0048.935] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.935] Sleep (dwMilliseconds=0x1) [0048.945] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.945] Sleep (dwMilliseconds=0x1) [0048.960] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.960] Sleep (dwMilliseconds=0x1) [0048.976] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.976] Sleep (dwMilliseconds=0x1) [0048.991] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0048.991] Sleep (dwMilliseconds=0x1) [0049.007] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.007] Sleep (dwMilliseconds=0x1) [0049.023] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.023] Sleep (dwMilliseconds=0x1) [0049.038] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.038] Sleep (dwMilliseconds=0x1) [0049.054] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.054] Sleep (dwMilliseconds=0x1) [0049.069] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.070] Sleep (dwMilliseconds=0x1) [0049.085] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.085] Sleep (dwMilliseconds=0x1) [0049.101] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.101] Sleep (dwMilliseconds=0x1) [0049.116] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.116] Sleep (dwMilliseconds=0x1) [0049.132] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.132] Sleep (dwMilliseconds=0x1) [0049.148] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.148] Sleep (dwMilliseconds=0x1) [0049.163] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.163] Sleep (dwMilliseconds=0x1) [0049.179] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.179] Sleep (dwMilliseconds=0x1) [0049.194] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.194] Sleep (dwMilliseconds=0x1) [0049.210] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.210] Sleep (dwMilliseconds=0x1) [0049.225] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.226] Sleep (dwMilliseconds=0x1) [0049.241] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.241] Sleep (dwMilliseconds=0x1) [0049.257] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.257] Sleep (dwMilliseconds=0x1) [0049.272] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.272] Sleep (dwMilliseconds=0x1) [0049.288] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.288] Sleep (dwMilliseconds=0x1) [0049.303] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.303] Sleep (dwMilliseconds=0x1) [0049.325] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.325] Sleep (dwMilliseconds=0x1) [0049.335] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.335] Sleep (dwMilliseconds=0x1) [0049.350] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.350] Sleep (dwMilliseconds=0x1) [0049.366] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.366] Sleep (dwMilliseconds=0x1) [0049.382] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.382] Sleep (dwMilliseconds=0x1) [0049.397] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.397] Sleep (dwMilliseconds=0x1) [0049.413] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.413] Sleep (dwMilliseconds=0x1) [0049.428] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.429] Sleep (dwMilliseconds=0x1) [0049.444] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.444] Sleep (dwMilliseconds=0x1) [0049.459] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.459] Sleep (dwMilliseconds=0x1) [0049.475] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.475] Sleep (dwMilliseconds=0x1) [0049.491] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.491] Sleep (dwMilliseconds=0x1) [0049.506] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.506] Sleep (dwMilliseconds=0x1) [0049.523] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.523] Sleep (dwMilliseconds=0x1) [0049.538] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.538] Sleep (dwMilliseconds=0x1) [0049.553] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.553] Sleep (dwMilliseconds=0x1) [0049.569] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.569] Sleep (dwMilliseconds=0x1) [0049.585] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.585] Sleep (dwMilliseconds=0x1) [0049.600] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.600] Sleep (dwMilliseconds=0x1) [0049.616] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.616] Sleep (dwMilliseconds=0x1) [0049.631] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.631] Sleep (dwMilliseconds=0x1) [0049.647] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.647] Sleep (dwMilliseconds=0x1) [0049.662] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.662] Sleep (dwMilliseconds=0x1) [0049.678] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.678] Sleep (dwMilliseconds=0x1) [0049.694] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.694] Sleep (dwMilliseconds=0x1) [0049.709] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.709] Sleep (dwMilliseconds=0x1) [0049.725] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.725] Sleep (dwMilliseconds=0x1) [0049.740] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.740] Sleep (dwMilliseconds=0x1) [0049.756] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.756] Sleep (dwMilliseconds=0x1) [0049.771] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.771] Sleep (dwMilliseconds=0x1) [0049.787] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.787] Sleep (dwMilliseconds=0x1) [0049.803] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.803] Sleep (dwMilliseconds=0x1) [0049.818] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.818] Sleep (dwMilliseconds=0x1) [0049.834] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.834] Sleep (dwMilliseconds=0x1) [0049.849] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.849] Sleep (dwMilliseconds=0x1) [0049.865] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.865] Sleep (dwMilliseconds=0x1) [0049.881] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.881] Sleep (dwMilliseconds=0x1) [0049.896] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.896] Sleep (dwMilliseconds=0x1) [0049.914] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=440, y=844)) returned 1 [0049.914] Sleep (dwMilliseconds=0x1) [0049.932] GetCursorPos (in: lpPoint=0x18f774 | out: lpPoint=0x18f774*(x=121, y=798)) returned 1 [0049.932] SetErrorMode (uMode=0x8001) returned 0x0 [0049.932] LoadLibraryA (lpLibFileName="advapi32") returned 0x76760000 [0049.932] SetErrorMode (uMode=0x0) returned 0x8001 [0049.933] GetProcAddress (hModule=0x76760000, lpProcName="RegOpenKeyExA") returned 0x76774907 [0049.933] SetErrorMode (uMode=0x8001) returned 0x0 [0049.933] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0049.933] SetErrorMode (uMode=0x0) returned 0x8001 [0049.933] GetProcAddress (hModule=0x765b0000, lpProcName="CloseHandle") returned 0x765c1410 [0049.933] SetErrorMode (uMode=0x8001) returned 0x0 [0049.933] LoadLibraryA (lpLibFileName="shell32") returned 0x75790000 [0050.946] SetErrorMode (uMode=0x0) returned 0x8001 [0050.946] GetProcAddress (hModule=0x75790000, lpProcName="ShellExecuteW") returned 0x757a3c71 [0050.947] SetErrorMode (uMode=0x8001) returned 0x0 [0050.947] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0050.947] SetErrorMode (uMode=0x0) returned 0x8001 [0050.947] GetProcAddress (hModule=0x765b0000, lpProcName="WriteFile") returned 0x765c1282 [0050.947] SetErrorMode (uMode=0x8001) returned 0x0 [0050.947] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0050.947] SetErrorMode (uMode=0x0) returned 0x8001 [0050.947] GetProcAddress (hModule=0x765b0000, lpProcName="CreateFileW") returned 0x765c3f5c [0050.947] SetErrorMode (uMode=0x8001) returned 0x0 [0050.947] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0050.947] SetErrorMode (uMode=0x0) returned 0x8001 [0050.947] GetProcAddress (hModule=0x765b0000, lpProcName="TerminateProcess") returned 0x765dd802 [0050.947] SetErrorMode (uMode=0x8001) returned 0x0 [0050.947] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0050.947] SetErrorMode (uMode=0x0) returned 0x8001 [0050.948] GetProcAddress (hModule=0x765b0000, lpProcName="VirtualProtectEx") returned 0x766445bf [0050.948] SetErrorMode (uMode=0x8001) returned 0x0 [0050.948] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0050.948] SetErrorMode (uMode=0x0) returned 0x8001 [0050.948] GetProcAddress (hModule=0x765b0000, lpProcName="CreateProcessW") returned 0x765c103d [0050.948] SetErrorMode (uMode=0x8001) returned 0x0 [0050.948] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0050.948] SetErrorMode (uMode=0x0) returned 0x8001 [0050.948] GetProcAddress (hModule=0x765b0000, lpProcName="GetTempPathW") returned 0x765dd4dc [0050.948] SetErrorMode (uMode=0x8001) returned 0x0 [0050.948] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0050.948] SetErrorMode (uMode=0x0) returned 0x8001 [0050.948] GetProcAddress (hModule=0x765b0000, lpProcName="GetLongPathNameW") returned 0x765ca315 [0050.948] SetErrorMode (uMode=0x8001) returned 0x0 [0050.948] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0050.948] SetErrorMode (uMode=0x0) returned 0x8001 [0050.948] GetProcAddress (hModule=0x765b0000, lpProcName="GetFileSize") returned 0x765c196e [0050.948] SetErrorMode (uMode=0x8001) returned 0x0 [0050.948] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0050.949] SetErrorMode (uMode=0x0) returned 0x8001 [0050.949] GetProcAddress (hModule=0x765b0000, lpProcName="ReadFile") returned 0x765c3ed3 [0050.949] VirtualAllocEx (hProcess=0xffffffff, lpAddress=0x0, dwSize=0x1ea, flAllocationType=0x3000, flProtect=0x4) returned 0x3b0000 [0050.954] SetErrorMode (uMode=0x8001) returned 0x0 [0050.954] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0050.954] SetErrorMode (uMode=0x0) returned 0x8001 [0050.954] GetProcAddress (hModule=0x765b0000, lpProcName="GetCommandLineW") returned 0x765c5223 [0050.954] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe\" " [0050.954] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe", lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x3470048*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x347008c | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe\" ", lpProcessInformation=0x347008c*(hProcess=0x148, hThread=0x144, dwProcessId=0xa20, dwThreadId=0xa24)) returned 1 [0050.957] SetErrorMode (uMode=0x8001) returned 0x0 [0050.957] LoadLibraryA (lpLibFileName="ntdll") returned 0x77560000 [0050.957] SetErrorMode (uMode=0x0) returned 0x8001 [0050.957] GetProcAddress (hModule=0x77560000, lpProcName="NtAllocateVirtualMemory") returned 0x7757fab0 [0050.957] SetErrorMode (uMode=0x8001) returned 0x0 [0050.957] LoadLibraryA (lpLibFileName="ntdll") returned 0x77560000 [0050.957] SetErrorMode (uMode=0x0) returned 0x8001 [0050.957] GetProcAddress (hModule=0x77560000, lpProcName="NtWriteVirtualMemory") returned 0x7757fe04 [0050.957] SetErrorMode (uMode=0x8001) returned 0x0 [0050.957] LoadLibraryA (lpLibFileName="ntdll") returned 0x77560000 [0050.957] SetErrorMode (uMode=0x0) returned 0x8001 [0050.958] GetProcAddress (hModule=0x77560000, lpProcName="NtTerminateThread") returned 0x77580074 [0050.958] SetErrorMode (uMode=0x8001) returned 0x0 [0050.958] LoadLibraryA (lpLibFileName="ntdll") returned 0x77560000 [0050.958] SetErrorMode (uMode=0x0) returned 0x8001 [0050.958] GetProcAddress (hModule=0x77560000, lpProcName="NtOpenEvent") returned 0x7757fe98 [0050.958] SetErrorMode (uMode=0x8001) returned 0x0 [0050.958] LoadLibraryA (lpLibFileName="ntdll") returned 0x77560000 [0050.958] SetErrorMode (uMode=0x0) returned 0x8001 [0050.958] GetProcAddress (hModule=0x77560000, lpProcName="NtUnmapViewOfSection") returned 0x7757fc70 [0050.958] NtUnmapViewOfSection (ProcessHandle=0x148, BaseAddress=0x400000) returned 0x0 [0050.958] NtAllocateVirtualMemory (in: ProcessHandle=0x148, BaseAddress=0x3470004*=0x400000, ZeroBits=0x0, RegionSize=0x3476118*=0x24000, AllocationType=0x3000, Protect=0x40 | out: BaseAddress=0x3470004*=0x400000, RegionSize=0x3476118*=0x24000) returned 0x0 [0050.965] NtWriteVirtualMemory (in: ProcessHandle=0x148, BaseAddress=0x400000, Buffer=0x3476000*, NumberOfBytesToWrite=0x200, NumberOfBytesWritten=0x0 | out: Buffer=0x3476000*, NumberOfBytesWritten=0x0) returned 0x0 [0050.965] NtWriteVirtualMemory (in: ProcessHandle=0x148, BaseAddress=0x400000, Buffer=0x3476000*, NumberOfBytesToWrite=0x1, NumberOfBytesWritten=0x0 | out: Buffer=0x3476000*, NumberOfBytesWritten=0x0) returned 0x0 [0050.965] NtWriteVirtualMemory (in: ProcessHandle=0x148, BaseAddress=0x401000, Buffer=0x3477000*, NumberOfBytesToWrite=0x22a00, NumberOfBytesWritten=0x0 | out: Buffer=0x3477000*, NumberOfBytesWritten=0x0) returned 0x0 [0050.966] SetErrorMode (uMode=0x8001) returned 0x0 [0050.967] LoadLibraryA (lpLibFileName="ntdll") returned 0x77560000 [0050.967] SetErrorMode (uMode=0x0) returned 0x8001 [0050.967] GetProcAddress (hModule=0x77560000, lpProcName="NtGetContextThread") returned 0x77580c20 [0050.967] NtGetContextThread (in: ThreadHandle=0x144, Context=0x347009c | out: Context=0x347009c*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x4012a4, Ebp=0x0, Eip=0x775701c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x40, [6]=0x2, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0050.967] NtWriteVirtualMemory (in: ProcessHandle=0x148, BaseAddress=0x7efde008, Buffer=0x3470004*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x0 | out: Buffer=0x3470004*, NumberOfBytesWritten=0x0) returned 0x0 [0050.967] SetErrorMode (uMode=0x8001) returned 0x0 [0050.967] LoadLibraryA (lpLibFileName="ntdll") returned 0x77560000 [0050.968] SetErrorMode (uMode=0x0) returned 0x8001 [0050.968] GetProcAddress (hModule=0x77560000, lpProcName="NtSetContextThread") returned 0x77581910 [0050.968] NtSetContextThread (ThreadHandle=0x144, Context=0x347009c*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x418c20, Ebp=0x0, Eip=0x775701c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x40, [6]=0x2, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0050.968] SetErrorMode (uMode=0x8001) returned 0x0 [0050.968] LoadLibraryA (lpLibFileName="ntdll") returned 0x77560000 [0050.968] SetErrorMode (uMode=0x0) returned 0x8001 [0050.968] GetProcAddress (hModule=0x77560000, lpProcName="NtResumeThread") returned 0x77580058 [0050.968] NtResumeThread (in: ThreadHandle=0x144, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0050.968] SetErrorMode (uMode=0x8001) returned 0x0 [0050.968] LoadLibraryA (lpLibFileName="kernel32") returned 0x765b0000 [0050.968] SetErrorMode (uMode=0x0) returned 0x8001 [0050.969] GetProcAddress (hModule=0x765b0000, lpProcName="GetExitCodeProcess") returned 0x765d174d [0050.969] GetExitCodeProcess (in: hProcess=0x148, lpExitCode=0x34707fc | out: lpExitCode=0x34707fc*=0x103) returned 1 [0050.969] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 2 os_tid = 0xa00 Process: id = "2" image_name = "ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe" page_root = "0x6653f000" os_pid = "0xa20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9e8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ab17c139b27a1884df468664b2ae448a6bfd8973034b6bfa42d03a3533edbe8d.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010611" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 215 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 216 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 217 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 218 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 219 start_va = 0x90000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 220 start_va = 0x190000 end_va = 0x193fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 221 start_va = 0x400000 end_va = 0x423fff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 222 start_va = 0x77380000 end_va = 0x77528fff entry_point = 0x77380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 223 start_va = 0x77560000 end_va = 0x776dffff entry_point = 0x77560000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 224 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 225 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 226 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 227 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 228 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 229 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 230 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 231 start_va = 0x2b0000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 232 start_va = 0x73a70000 end_va = 0x73acbfff entry_point = 0x73aaf798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 233 start_va = 0x73ad0000 end_va = 0x73b0efff entry_point = 0x73afde78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 234 start_va = 0x73b40000 end_va = 0x73b47fff entry_point = 0x73b420f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 235 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 236 start_va = 0x1a0000 end_va = 0x206fff entry_point = 0x1a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 237 start_va = 0x540000 end_va = 0x63ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 238 start_va = 0x75320000 end_va = 0x75365fff entry_point = 0x75327478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 239 start_va = 0x765b0000 end_va = 0x766bffff entry_point = 0x765c32d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 240 start_va = 0x77160000 end_va = 0x77259fff entry_point = 0x0 region_type = private name = "private_0x0000000077160000" filename = "" Region: id = 241 start_va = 0x77260000 end_va = 0x7737efff entry_point = 0x0 region_type = private name = "private_0x0000000077260000" filename = "" Region: id = 242 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 243 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 244 start_va = 0x780000 end_va = 0x900fff entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 245 start_va = 0x910000 end_va = 0xc12fff entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 246 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Thread: id = 3 os_tid = 0xa24 [0051.012] RtlGetProcessHeaps (in: HeapCount=0x2, HeapArray=0x18f36c | out: HeapArray=0x18f36c*=0x540000) returned 0x1 [0051.017] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Windows\\SysWOW64\\ntdll.dll", NtPathName=0x18f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Windows\\SysWOW64\\ntdll.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0051.020] NtCreateFile (in: FileHandle=0x18f34c, DesiredAccess=0x120089, ObjectAttributes=0x18f308*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x18f328, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x18f34c*=0x20, IoStatusBlock=0x18f328*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0051.031] NtQueryInformationFile (in: FileHandle=0x20, IoStatusBlock=0x18f328, FileInformation=0x18f280, Length=0x18, FileInformationClass=0x5 | out: IoStatusBlock=0x18f328, FileInformation=0x18f280) returned 0x0 [0051.050] NtReadFile (in: FileHandle=0x20, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x18f328, Buffer=0x640020, BufferLength=0x13b740, ByteOffset=0x18f298*=0, Key=0x0 | out: IoStatusBlock=0x18f328, Buffer=0x640020*) returned 0x0 [0051.140] NtClose (Handle=0x20) returned 0x0 [0051.190] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Windows\\SysWOW64\\ntdll.dll", NtPathName=0x18f2c0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Windows\\SysWOW64\\ntdll.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0051.190] NtCreateFile (in: FileHandle=0x18f2ec, DesiredAccess=0x120089, ObjectAttributes=0x18f2a8*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x18f2c8, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x18f2ec*=0x20, IoStatusBlock=0x18f2c8*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0051.190] NtQueryInformationFile (in: FileHandle=0x20, IoStatusBlock=0x18f2c8, FileInformation=0x18f03c, Length=0x208, FileInformationClass=0x9 | out: IoStatusBlock=0x18f2c8, FileInformation=0x18f03c) returned 0x0 [0051.190] NtClose (Handle=0x20) returned 0x0 [0051.194] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x73b41320, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f2f8, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f2f8*(BaseAddress=0x73b41000, AllocationBase=0x73b40000, AllocationProtect=0x80, RegionSize=0x3000, State=0x1000, Protect=0x20, Type=0x1000000), ResultLength=0x0) returned 0x0 [0051.463] NtQuerySystemInformation (in: SystemInformationClass=0x23, SystemInformation=0x18f350, Length=0x2, ResultLength=0x0 | out: SystemInformation=0x18f350, ResultLength=0x0) returned 0x0 [0051.466] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18f374, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x18f374, ReturnLength=0x0) returned 0x0 [0051.478] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x18f004*=0x0, ZeroBits=0x0, RegionSize=0x18f008*=0x10000, AllocationType=0x1000, Protect=0x4 | out: BaseAddress=0x18f004*=0x20000, RegionSize=0x18f008*=0x10000) returned 0x0 [0051.482] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x20000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x20000, ResultLength=0x0) returned 0x0 [0051.493] NtFreeVirtualMemory (ProcessHandle=0xffffffff, BaseAddress=0x18f364*=0x20000, RegionSize=0x18f368, FreeType=0x8000) returned 0x0 [0051.502] RtlQueryEnvironmentVariable_U (in: Environment=0x0, Name="USERNAME", Value=0x18f120 | out: Value="5p5NrGJn0jS HALPmcxz") returned 0x0